| शीर्षक | 1Panel-dev MaxKB v1.10.6-lts CWE:1236 |
|---|
| विवरण | An insecure file upload vulnerability was discovered in the Knowledge Base module of MaxKB v1.10.6-lts. The application allows users to upload `.csv`, `.xls`, and other spreadsheet files without properly validating or sanitizing their content. As a result, an attacker can upload a file containing malicious spreadsheet formulas (e.g., starting with `=`, `+`, `-`, or `@`). When other users download and open the file in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the malicious payload can be executed, leading to potential security risks including command execution, phishing attacks, or data leakage. |
|---|
| स्रोत | ⚠️ https://github.com/yaowenxiao721/Poc/blob/main/MaxKB/MaxKB-poc1.md |
|---|
| उपयोगकर्ता | yaowenxiao (UID 82929) |
|---|
| सबमिशन | 28/04/2025 08:23 AM (1 वर्ष पहले) |
|---|
| संयम | 10/05/2025 05:31 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 308293 [1Panel-dev MaxKB तक 1.10.7 Knowledge Base अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|