# CVE-2025-0520

## Summary

ShowDoc Unauthenticated File Upload RCE via deprecated ThinkPHP syntax

## Description

ShowDoc versions before 2.8.7 contain an unrestricted file upload vulnerability. Due to deprecated ThinkPHP 3.1 syntax ($upload->allowExts instead of $upload->exts), attackers bypass extension checks using angle bracket tricks (e.g., test.<>php) to upload PHP webshells. The endpoint /index.php?s=/home/page/uploadImg is accessible without authentication.

**Root Cause:** server/Application/Home/Controller/PageController.class.php in uploadImg() uses deprecated ThinkPHP 3.1 $upload->allowExts which is ignored in ThinkPHP 3.2+. Extension whitelist not enforced. Attackers can upload PHP files stored in ./Public/Uploads/.

**Reproduction Strategy:**
1. Start vulnerable ShowDoc 2.8.2 environment (e.g., via Vulhub at vulhub/showdoc/CNVD-2020-26585)
2. POST to /index.php?s=/home/page/uploadImg with multipart/form-data containing malicious PHP file named 'test.<>php'
3. Uploaded PHP file stored at /Public/Uploads/ can be accessed directly for RCE

**Fix:**
- Commit fb77dd4: Changed $upload->allowExts to $upload->exts (correct ThinkPHP 3.2+ syntax)
- Commit e1cd02a: Defense in depth - disabled uploadImg endpoint by returning false

**References:**
- GHSA-6jmr-r7p6-f5wr
- https://github.com/star7th/showdoc/commit/fb77dd4db88dc23f5e570fc95919ee882aca520a
- https://github.com/star7th/showdoc/commit/e1cd02a3f98bb227c0599e7fa6b803ab1097597f

## Metadata

- Product: showdoc/showdoc
- Severity: critical
- Status: open