| عنوان | formtools.org / Form Tools project Form Tools Core 3.1.1 Unrestricted Upload |
|---|
| الوصف | The FormTools AJAX handler global/code/actions.php exposes smart_fill upload actions that save an uploaded file (only prefixed ft_sf_tmp_) into the default Web-accessible rootDir/upload directory via Files::uploadFile(), which performs no extension/MIME/content validation before rename() and chmod 0777. The endpoint accepts any authenticated account (checkAuth('user', false) allows admin and client) and is not CSRF-protected, so a PHP web shell can be uploaded and executed. |
|---|
| المصدر | ⚠️ https://github.com/wawyw/cve_report/blob/main/formtools_2.md |
|---|
| المستخدم | wenyouwen (UID 99589) |
|---|
| ارسال | 03/09/2026 09:36 AM (29 أيام منذ) |
|---|
| الاعتدال | 30/09/2026 09:07 PM (27 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 412351 [formtools.org Form Tools حتى 3.1.1 Ajax global/code/actions.php Files::uploadFile تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|