| शीर्षक | QubePlug Bangladesh PipraPay 3.0.0 Unrestricted File Upload |
|---|
| विवरण | PipraPay 3.0.0 is vulnerable to unrestricted file upload leading to remote code execution. The system-settings-import action accepts a ZIP archive and validates only its extension, then extracts the archive and recursively copies its contents into the web root without validating file names or types.
An authenticated user with the manage_import permission can upload a PHP webshell, which is written to the web root and executed when requested over HTTP, leading to full server compromise.
Reproduction: https://github.com/sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import%20ZIP%20Upload%20RCE%20(CWE-434)_cve.md |
|---|
| स्रोत | ⚠️ https://github.com/PipraPay/PipraPay/issues/68 |
|---|
| उपयोगकर्ता | summmm (UID 69690) |
|---|
| सबमिशन | 17/10/2026 03:28 PM (23 दिन पहले) |
|---|
| संयम | 09/11/2026 07:59 AM (23 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 433048 [PipraPay 3.0.0 ZIP Archive system-settings-import अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|