Halit Akaydin

Authenticated users with theme installation permissions can execute arbitrary commands by uploading malicious theme files. An attacker can upload a crafted theme package through the 'theme.php' endpoint to deploy a web shell in the e107 themes directory, subsequently executing system commands via the 'payload.php' script.

Remote code execution is possible in the autotasks administrative interface. Authenticated attackers can execute arbitrary PHP code by injecting malicious content into the `sat code` parameter. This is achieved by sending a POST request to the '/modules/system/admin.php?fct=autotasks&op=mod' endpoint with a manipulated `sat code` containing PHP commands, which results in the creation of an executable file that accepts arbitrary commands via GET parameters.

Authenticated users with module creation permissions can execute arbitrary system commands by injecting PHP code into module parameters. This is achieved by sending POST requests to the '/manager/index.php' endpoint using the `post` parameter to create modules that execute commands upon invocation.

The software contains an unauthenticated file upload issue that enables remote attackers to execute arbitrary code. This is achieved by bypassing file extension checks, allowing attackers to upload a PHP file disguised as a PNG. After uploading, the file can be renamed and used to execute system commands through a crafted web shell parameter.

WebsiteBaker version 2.13.0 has a flaw that permits authenticated users with language editing rights to execute code remotely. This is possible through manipulation of parameters within the language installation endpoint, allowing for remote code execution on the server.

The software contains an authenticated remote code execution issue in the content editing functionality. Administrative users can upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file, enabling arbitrary command execution on the server. The vulnerability allows for the execution of code on the server.