| शीर्षक | CodeAstro Online Railway Reservation System 1.0 Unrestricted Upload of File with Dangerous Type |
|---|
| विवरण | A critical remote code execution (RCE) vulnerability has been identified in the Online Railway Reservation System developed by CodeAstro. The vulnerability is found in the /admin/emp-profile-avatar.php component, which is responsible for handling profile avatar uploads in the application's admin panel.
The issue arises from improper validation of uploaded files. Attackers can exploit this flaw by uploading a malicious file, such as a web shell, through the vulnerable endpoint. Once uploaded, the attacker can access the web shell and execute arbitrary commands on the server with the privileges of the web server process. |
|---|
| स्रोत | ⚠️ https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/RCE%20via%20File%20Upload.md |
|---|
| उपयोगकर्ता | Raj Nandi (UID 73232) |
|---|
| सबमिशन | 15/08/2024 08:31 AM (2 साल पहले) |
|---|
| संयम | 17/08/2024 07:16 PM (2 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 275036 [CodeAstro Online Railway Reservation System 1.0 Profile Photo Update emp-profile-avatar.php अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|