| عنوان | JPShop JPShop <=1.5.02 Arbitrary file upload |
|---|
| الوصف | The JPShop e-commerce platform, version 1.5.02 and earlier, has a critical security vulnerability in its file upload feature. In the file "/api/controllers/common/UploadsController.php", the function "actionUpdate" accepts a parameter called "imgage" which can be manipulated to upload arbitrary files, including malicious PHP scripts. This can be exploited by an attacker to gain remote code execution capabilities on the server, posing a significant risk to the application's security. |
|---|
| المصدر | ⚠️ https://note.zhaoj.in/share/f8b2IX7GsZS5 |
|---|
| المستخدم | glzjin (UID 59815) |
|---|
| ارسال | 05/02/2024 07:42 AM (3 سنوات منذ) |
|---|
| الاعتدال | 06/02/2024 09:29 AM (1 day later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 253003 [Juanpao JPShop حتى 1.5.02 UploadsController.php actionUpdate imgage تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|