| शीर्षक | Gacjie Servers Data Management System <=1.0 Arbitrary File Upload |
|---|
| विवरण | The Servers Data Management System, specifically in its version 1.0 or below, has been identified to contain an Arbitrary File Upload vulnerability within its /app/admin/controller/Upload.php file. This vulnerability stems from the index function's failure to implement adequate file validation mechanisms, thereby allowing attackers to upload malicious PHP files without any restrictions. By exploiting this flaw, an attacker can upload a PHP script to the server via a crafted HTTP POST request to the endpoint /index.php/admin/Upload/index.html. Once uploaded, the attacker can execute arbitrary code by accessing the uploaded PHP file, potentially compromising the server or its data. This vulnerability was disclosed by the researcher glzjin, highlighting a significant security oversight in the application's file upload functionality. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/7kZiVRqSuiMx |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 04/03/2024 04:35 PM (2 साल पहले) |
|---|
| संयम | 12/03/2024 04:16 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 256503 [Gacjie Server तक 1.0 Upload.php index Arquivo अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|