CVE-2017-7402

published 2017-04-03

CVE-2017-7402: Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request…

Priority P2 62 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
lucidcrew	pixie	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /pixie_v1.04/admin/index.php?s=publish&x=filemanager↗

path /files/other/our_shell.jpg.php↗

hash 44791fdde14260bc7a8d08df65bcd048↗

command our_shell.jpg.php?cmd=ipconfig↗

• → Monitor POST requests to admin/index.php with query parameters s=publish&x=filemanager for suspicious file upload activity, especially from low-privilege (client) accounts. ↗
• → Alert on HTTP requests to /files/other/ paths containing .jpg.php or similar double-extension filenames, which indicate successful webshell upload and execution attempts. ↗
• → Detect the presence of the ?cmd= parameter in GET requests to uploaded files under the Pixie CMS /files/ directory, indicating webshell command execution. ↗
• → Look for the cookie name 'pixie_login' with a value prefixed by 'client%2C' in requests to the admin file manager, indicating exploitation by a low-privilege client account. ↗

• · The exploit requires the attacker to already be authenticated (remote authenticated users); unauthenticated exploitation is not possible. Both Administrator and Client privilege levels can access the file manager and are affected. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94