CVE-2023-24776: 
PHP vulnerability analysis and mitigation

Funadmin v3.2.0 contains a remote code execution (RCE) vulnerability via the component \controller\Addon.php. The vulnerability was discovered and disclosed in March 2023, affecting the background offline plugin installation functionality of the Funadmin content management system (NVD, GitHub Issue).

The vulnerability exists in the plugin installation mechanism within the app\backend\controller\Addon.php file. The system fails to properly filter malicious code during the plugin installation process, allowing attackers to construct and upload malicious plugin controllers. An example attack vector involves creating a specially crafted tarball containing malicious code in the snowflake\controller\Index.php file (GitHub Issue).

A successful exploitation of this vulnerability allows attackers to execute arbitrary code on the affected system, potentially leading to complete system compromise. The vulnerability enables attackers to execute commands with the same privileges as the web server process (NVD).

The vulnerability can be exploited by uploading a malicious plugin through the background offline installation feature. A proof of concept exists demonstrating the execution of phpinfo() through a crafted plugin controller (GitHub Issue).

Users should upgrade from version 3.2.0 to a patched version of Funadmin. If immediate upgrading is not possible, it is recommended to disable the plugin installation functionality until the update can be applied (NVD).