| Titre | XCMS 1.0 Unrestricted Upload |
|---|
| Description | XCMS's front-end file upload interface lacks strict validation of uploaded file type, content, and file extension. Attackers can upload malicious files of any format (such as PHP webshells) without logging in. After a successful upload, the file can be accessed and executed directly via an HTTP request, ultimately leading to remote code execution. |
|---|
| La source | ⚠️ https://gitee.com/jackq/XCMS/issues/IDC4ZT |
|---|
| Utilisateur | formanagain (UID 93347) |
|---|
| Soumission | 10/12/2025 09:12 (il y a 10 mois) |
|---|
| Modérer | 27/12/2025 00:14 (17 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 338480 [jackq XCMS upload.php élévation de privilèges] |
|---|
| Points | 18 |
|---|