Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import

Summary

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.

Remediation

1. Inventory every thexerteproject xerteonlinetoolkits deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import
• Referencehttps://github.com/thexerteproject/xerteonlinetoolkits
• Referencehttps://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/functions.php#L419
• Referencehttps://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_code/php/language/import_language.php#L211
• Referencehttps://github.com/thexerteproject/xerteonlinetoolkits/issues/1557