A vulnerability has been found in cyberaz0r WebRAT up to 20191222 and classified as critical. This vulnerability affects the function download_file of the file Server/api.php. The manipulation of the argument name leads to unrestricted upload. Using CWE to declare the problem leads to CWE-434. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The weakness was disclosed 04/14/2020 as 0c394a795b9c10c07085361e6fcea286ee793701. The advisory is available at github.com. This vulnerability was named CVE-2020-36825. The attack can be initiated remotely. Technical details are available. There is no exploit available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. This vulnerability is assigned to T1608.002 by the MITRE ATT&CK project. It is declared as not defined. As 0-day the estimated underground price was around $0-$5k. The patch is identified as 0c394a795b9c10c07085361e6fcea286ee793701. The bugfix is ready for download at github.com. It is recommended to apply a patch to fix this issue. A possible mitigation has been published immediately after the disclosure of the vulnerability.