| शीर्षक | Realce Tecnologia Queue ticket kiosk web application N/A Improper File Upload Validation |
|---|
| विवरण | Title: Realce Tecnologia queue ticket kiosk vulnerable to Improper File Upload Validation
Software affected: Realce tecnologia web application in queue ticket kiosk (There is no version in the application pages)
Vendor: Realce Tecnologia - https://www.realcetecnologia.com.br/
Description:
The application includes a logo upload functionality that is intended to accept only JPG, PNG, GIF, WEBP or JPEG files. However, file type validation is performed client-side, and can be bypassed by modifying the request manually, allowing attackers to upload unauthorized PHP files.
Technical Details:
Using a proxy tool like Burp Suite, an attacker can intercept the upload request and change the filename and content-type to reflect a .php file. The application fails to enforce proper server-side validation and accepts the file.
Impact:
If the uploaded PHP file is accessible from the web server, this can lead to webshells, remote code execution (RCE), full system compromise, or data leakage.
The exploitation evidences will be sent by e-mail. |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 17/05/2025 04:43 PM (1 वर्ष पहले) |
|---|
| संयम | 25/05/2025 07:14 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 310266 [Realce Tecnologia Queue Ticket Kiosk तक 20250517 Image File /adm/ajax.php files[] अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|