| शीर्षक | PandaX PandaX latest Arbitrary File Overwrite or Read |
|---|
| विवरण | The code does not check the passed `filename`. Use `../` to specify the exported excel file name and directory location across directories, which can be used to overwrite files that should not be overwritten.
Moreover, if the target file does not have write permission, `rc.Download(fileName)` will download the file again and it will become a file read. |
|---|
| स्रोत | ⚠️ https://github.com/PandaXGO/PandaX/issues/6 |
|---|
| उपयोगकर्ता | linyz-tel (UID 44909) |
|---|
| सबमिशन | 10/03/2024 04:37 AM (3 साल पहले) |
|---|
| संयम | 16/03/2024 08:10 AM (6 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 257063 [PandaXGO PandaX तक 20240310 /apps/system/api/user.go ExportUser filename अधिकार वृद्धि] |
|---|
| अंक | 18 |
|---|