| शीर्षक | Automad CMS <= 1.10.9 Unrestricted File Upload |
|---|
| विवरण | Description:
By default, in the config.php files, the application allows upload files containing dangerous types, such as SVG and PDF. The application also not validate the content type, as shown in the code snippets below are associated with the upload method in the FileCollectionController.php file, located at src\UI\Controllers.
This issue allow pentester to upload a SVG or PDF file contains malicious content to execute arbitrary JS code which acts as a stored XSS payload. |
|---|
| स्रोत | ⚠️ https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Unrestricted%20File%20Upload |
|---|
| उपयोगकर्ता | Maland (UID 59886) |
|---|
| सबमिशन | 09/12/2023 06:12 PM (3 साल पहले) |
|---|
| संयम | 21/12/2023 09:19 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 248685 [automad तक 1.10.9 Content Type FileCollectionController.php upload अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|