1) Summary  
Affected software CMS Made Simple-2.2.15  
Vendor URL <>  
Vulnerability File upload bypass with .phar extension lead to RCE  
2) Vulnerability Description  
The vulnerability affect the `FilePicker` module,  
it is possible to bypass the restriction and upload a malicious file with `.phar` extension to gain Remote Code Execution.  
This vulnerability is remotely exploitable and require authentication.  
3) PoC and details  
* Login into the admin area and surf to the `MicroTiny WYSIWYG editor` functionality then click on the insert/edit image button  
* A new window will be opened, now click on the search button, the `CMSMS File Picker` will be shown  
* Click on the upload button and Select the .phar file  
* Surf to uploads/your-file-name.phar and enjoy the shell  
The exploit is working because the upload handler checks only if the extension contains the `php` string (obviously `phar` does not match).  
The exploit works fine on a standard Ubuntu system, here the configuration used for the tests:  
* Linux ubuntu 5.4.0-58-generic  
* php version 7.4.3  
* Apache/2.4.41 (Ubuntu)  
* File Picker version = "1.0.5"  
* CMS Made Simple-2.2.15  
More details here:  
4) Credits  
This vulnerability has been discovered and reported  
by Riccardo Krauter researcher @ Soter IT Security (  
5) Timeline  
2021/02/26 Vendor was informed  
2021/02/26 Vendor said he won't fix  
2021/03/17 Public disclosure