| शीर्षक | JPShop JPShop <=1.5.02 Arbitrary file upload |
|---|
| विवरण | The JPShop, a popular e-commerce platform, has an arbitrary file upload vulnerability in its version 1.5.02 and earlier. The bug lies in the MaterialController.php file, specifically in the actionUpdate function. This function accepts parameters, one of which is pic_url that is saved as a file. Despite having an error, it's still possible to upload a file using tools like Postman and gain the filename to access it. This vulnerability could potentially allow malicious users to upload and execute arbitrary code, posing a significant security risk. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/C1btykKlahBD |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 05/02/2024 04:06 AM (3 साल पहले) |
|---|
| संयम | 06/02/2024 09:29 AM (1 day later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 253001 [Juanpao JPShop तक 1.5.02 API MaterialController.php actionUpdate pic_url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|