CVE-2024-58279
Published: 10 December 2025
Description
appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading…
more
a crafted PHP file to the site's uploads directory.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the flaw in the filemanager upload endpoint of appRain CMF 4.0.5 that permits unrestricted uploading of malicious PHP files leading to RCE.
Implements input validation mechanisms at the filemanager upload endpoint to detect and reject malicious PHP files, preventing exploitation of the unrestricted file upload vulnerability.
Enforces secure web server configuration settings to disable PHP execution in the uploads directory, blocking RCE even if malicious files are uploaded.
Security SummaryAI
CVE-2024-58279 is an authenticated remote code execution vulnerability in appRain CMF 4.0.5. The flaw resides in the filemanager upload endpoint, which permits administrative users to upload malicious PHP files directly to the site's uploads directory, bypassing restrictions on dangerous file types (CWE-434). This issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to network accessibility and low privilege requirements.
Attackers with valid administrative credentials can exploit the vulnerability by crafting and uploading a malicious PHP file through the filemanager endpoint. Successful exploitation allows them to establish a web shell in the uploads directory, granting remote command execution on the server. This enables full compromise of the affected system, including data exfiltration, persistence, or further lateral movement.
Advisories and references, including the VulnCheck advisory on apprain-cmf authenticated RCE via filemanager upload and an Exploit-DB entry (52041) with proof-of-concept exploit code, document the issue. The appRain project site and GitHub archive for v4.0.5 provide additional context on the vulnerable version, though no specific patches or mitigations are detailed in the available information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated RCE via unrestricted file upload in a public-facing web app (T1190) directly facilitates deployment of a PHP web shell for remote command execution (T1505.003).