[modx/revolution] Unrestricted Upload of File with Dangerous Type in MODX Revolution

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-26149
• https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt
• https://github.com/advisories/GHSA-j8jp-9×42-4pj5