Upload web shell flatcore Version 2.0.8

[ngochieu-kiminawa]

Upload web shell
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Login to flatcore CMS (admin user)
2. Click on 'Addons'
3. Click on 'Install'
4. Click on 'Plugin'
5. Choose a malious PHP file example is webshell.php
6. URL for malious PHP file: http://domain/upload/plugins/webshell.php
   

Screenshots
This POC for vuln :https://youtu.be/3w1M9eL_JiI
file payload
webshell.zip

Desktop (please complete the following information):

OS: tested in Linux
Browser : All
Version : Last version

Additional context
This vulnerability is extremely serious affecting the system. An attacker can take control of the entire server.

[patkon]

That's the same as Issue #58

[hieuminhnv]

@patkon
Has RCE via Module Addons been fixed yet? on version 2.0.9

[patkon]

Not really fixed. The admin has to confirm a message that he knows what he is uploading.
See: Issue #54
I'm working on the possibility that you can turn off the entire upload vie config.php file.

[patkon]

And here we go. Uploads for Addons are deactivated by default now. You can switch this on/off in your own config.php file.