Authenticated Remote Code Execution via Malicious Extension Uploads

Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and trigger execution by accessing the About tab of the installed extension.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Schlix CMS 2.2.6-6 contains a critical remote code execution vulnerability affecting authenticated users who can access the block manager. Attackers with valid credentials can upload specially crafted ZIP extension packages containing malicious PHP code in the packageinfo.inc file. When the extension is installed and the About tab is accessed, the PHP code executes with application-level privileges. This vulnerability is particularly dangerous because it bridges the gap between authentication and arbitrary code execution, meaning compromised accounts or insider threats can achieve complete system compromise. Any organization running Schlix CMS 2.2.6-6 should immediately assess their user access controls and consider upgrading to patched versions.

Casky's 301 mapped security skills leverage Claude's extended reasoning to detect the attack chain underlying this vulnerability across two critical MITRE ATT&CK phases: Initial Access (TA0001) and Resource Development (TA0043). Practitioners using Casky would identify indicators including: suspicious ZIP file uploads to the block manager with embedded PHP files, anomalous file writes to extension directories containing executable code, and execution of PHP code from unexpected file paths during extension installation workflows. The platform's skills would flag the critical transition from file upload to code execution, highlighting the abuse of the extension installation process as a delivery mechanism. By mapping these behavioral patterns against 754 security skills, practitioners can detect both the staging activities (malicious package creation and upload) and the execution phase (PHP code invocation), enabling rapid incident response before attackers achieve persistence or lateral movement.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2021-47964.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2021-47964

Casky has 301 skills that investigate the attack patterns behind CVE-2021-47964. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn