Liufee
Monthly
Cookie validation key forgery in liufee FeehiCMS up to 2.1.1 allows unauthenticated remote attackers to craft arbitrary signed cookies by exploiting a hardcoded (or empty) `cookieValidationKey` in the production backend configuration file `environments/prod/backend/config/main-local.php`. Because FeehiCMS is built on the Yii2 framework, this key is used for HMAC-based cookie integrity verification; a known or empty key trivially breaks that guarantee, enabling session/cookie forgery that can lead to authentication bypass and backend access. A public proof-of-concept exploit exists (FEHI-003-Empty-cookieValidationKey), and no vendor patch has been issued despite responsible disclosure through a GitHub issue.
Server-side request forgery in FeehiCMS up to version 2.1.1 allows authenticated high-privilege users to make the backend server issue arbitrary HTTP requests by manipulating the source[] parameter in the UEditor catchImage function. The CVSS 4.0 vector confirms network-reachable exploitation requiring high privileges (PR:H), limiting the attack surface to authenticated backend administrators. A public proof-of-concept writeup has been published on GitHub and the vendor has not responded to the responsible disclosure issue filed against the repository.
Unrestricted file upload in FeehiCMS up to version 2.1.1 allows unauthenticated remote attackers to upload arbitrary files through the UEditor widget endpoint (UeditorAction::init in backend/widgets/ueditor/UeditorAction.php). A named public proof-of-concept (FEHI-001-UEditor-Unauthorized-File-Upload) is available on GitHub, enabling straightforward exploitation. The vendor has not responded to the coordinated disclosure issue filed at GitHub, and no patch exists at time of analysis.
Cookie validation key forgery in liufee FeehiCMS up to 2.1.1 allows unauthenticated remote attackers to craft arbitrary signed cookies by exploiting a hardcoded (or empty) `cookieValidationKey` in the production backend configuration file `environments/prod/backend/config/main-local.php`. Because FeehiCMS is built on the Yii2 framework, this key is used for HMAC-based cookie integrity verification; a known or empty key trivially breaks that guarantee, enabling session/cookie forgery that can lead to authentication bypass and backend access. A public proof-of-concept exploit exists (FEHI-003-Empty-cookieValidationKey), and no vendor patch has been issued despite responsible disclosure through a GitHub issue.
Server-side request forgery in FeehiCMS up to version 2.1.1 allows authenticated high-privilege users to make the backend server issue arbitrary HTTP requests by manipulating the source[] parameter in the UEditor catchImage function. The CVSS 4.0 vector confirms network-reachable exploitation requiring high privileges (PR:H), limiting the attack surface to authenticated backend administrators. A public proof-of-concept writeup has been published on GitHub and the vendor has not responded to the responsible disclosure issue filed against the repository.
Unrestricted file upload in FeehiCMS up to version 2.1.1 allows unauthenticated remote attackers to upload arbitrary files through the UEditor widget endpoint (UeditorAction::init in backend/widgets/ueditor/UeditorAction.php). A named public proof-of-concept (FEHI-001-UEditor-Unauthorized-File-Upload) is available on GitHub, enabling straightforward exploitation. The vendor has not responded to the coordinated disclosure issue filed at GitHub, and no patch exists at time of analysis.