| Titre | XCMS 1.1 Unrestricted Upload |
|---|
| Description | XCMS's backend file upload interface lacks strict validation of uploaded file types, content, and file extensions. Attackers can upload malicious files of any format (such as PHP webshells) after logging in. Once uploaded successfully, attackers can directly access and execute the file via HTTP requests, ultimately leading to remote code execution. |
|---|
| La source | ⚠️ https://gitee.com/jackq/XCMS/issues/IDC5C8 |
|---|
| Utilisateur | formanagain (UID 93347) |
|---|
| Soumission | 10/12/2025 09:36 (il y a 10 mois) |
|---|
| Modérer | 27/12/2025 00:14 (17 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 338481 [jackq XCMS Backend ProductImageController.class.php upload file élévation de privilèges] |
|---|
| Points | 18 |
|---|