| शीर्षक | TenSent SentCMS ≤4.0.5 Pre-Auth Arbitrary File upload |
|---|
| विवरण | The SentCMS application, specifically in versions up to and including 4.0.5, is vulnerable to a pre-authentication arbitrary file upload flaw located in the app/controller/Upload.php file. This vulnerability allows an attacker to upload a malicious PHP file without authentication by crafting a specially designed HTTP request to the file upload functionality, which improperly handles file storage. Once the file is uploaded, the attacker can navigate to the file's location and execute arbitrary code on the server, potentially leading to remote code execution (RCE). |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/5vbNXu5zHTs3 |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 06/01/2024 06:34 PM (3 साल पहले) |
|---|
| संयम | 11/01/2024 10:57 AM (5 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 194498 [SentCMS तक 4.0.x /user/upload/upload अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|