| शीर्षक | TemmokuMVC TemmokuMVC <=2.3 Arbitrary File Creation |
|---|
| विवरण | The TemmokuMVC system, version 2.3 and below, has an Arbitrary File Creation vulnerability in the images_get_down.php file. This vulnerability arises from the system parsing and downloading all image tags in an article to local storage, including URLs with a PHP suffix. An attacker can exploit this by starting a server that responds with PHP code disguised as an image, which gets saved on the server. The attacker can then brute force the filename to execute the arbitrary PHP code, leading to Remote Code Execution (RCE). |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/OrBH8zLKUPOA |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 11/02/2024 04:15 PM (3 साल पहले) |
|---|
| संयम | 22/02/2024 03:35 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 254532 [TemmokuMVC तक 2.3 Image Download lib/images_get_down.php get_img_url/img_replace अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|