| शीर्षक | Zend.To Zend.to Before6.10-7 Beta Code Injection |
|---|
| विवरण | Unauthenticated Remote Code Execution vulnerability in Zend.To before 6.10-7 Beta version. A command injection vulnerability was discovered in the NSSDropoff.php file, where user-supplied tmp_name parameters from file uploads are passed unsanitized to exec() calls. This allows unauthenticated attackers to execute arbitrary system commands during file upload. The issue was identified in a publicly available unofficial codebase that mirrors the original Zend.To functionality. |
|---|
| स्रोत | ⚠️ https://matheuscezar.github.io/2025/05/24/0-day-in-zend-to.html |
|---|
| उपयोगकर्ता | pnshbr (UID 19012) |
|---|
| सबमिशन | 03/06/2025 05:06 AM (1 वर्ष पहले) |
|---|
| संयम | 09/06/2025 09:02 PM (7 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 311789 [Zend.To तक 6.10-6 Beta NSSDropoff.php exec file_1 अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|