Summary

In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP tags and executed. Proper sanitization is not performed, and by injecting malicious code an attacker can execute arbitrary PHP code. This allows an attacker to achieve RCE.

Details

The attacker requires administrator privileges.
The attacker uses the administrator's PHPSESSID and runs a curl command like the following.

curl -v -s -b "PHPSESSID=aef60bb41816691c8cf55df70e96691a" \
  --data-urlencode "type=core';shell_exec('touch /tmp/malicious.txt');//" \
  'http://localhost:8080/admin_area/actions/update_launch.php'

As a result, a shell command is executed on PHP, and /tmp/malicious.txt is created on the web server.

This occurs because the application constructs a string containing a PHP tag in the variable $data by inserting $_POST['type'] without sanitization, and that string is ultimately executed via shell_exec($cmd).
Because type can be freely set by the client, the server must properly sanitize it.

PoC

Impact

An attacker can insert arbitrary PHP code, which enables RCE.