Arbitrary Code Execution Vulnerability in Sitemagic CMS by Sitemagic

CVE-2019-9042

What is CVE-2019-9042?

An issue in Sitemagic CMS v4.4 allows for potential arbitrary code execution via the index.php?SMExt=SMFiles URI, where users can upload .php files if the FileExtensionFilter is not configured by the administrator. This exploit is particularly risky when there are untrusted user accounts present, enabling unauthorized code execution. Although the maintainer suggests that this behavior is intended as a feature when used with External Modules, it still poses significant security implications.

References