| शीर्षक | Harry Yu MoneyPrinterTurbo v1.2.6 Incomplete Identification of Uploaded File Variables |
|---|
| विवरण | app/controllers/v1/video.py:207-223 / upload_bgm_file: This function only checks if the file extension is '.mp3' and does not verify the actual content type of the file. This allows attackers to upload files with an '.mp3' extension that contain malicious content. Additionally, there is no file size limit, which could lead to exhaustion of storage resources. Furthermore, files are saved directly using their original filenames without sanitization, potentially allowing attackers to overwrite critical system files. |
|---|
| उपयोगकर्ता | zhangjx (UID 87395) |
|---|
| सबमिशन | 04/07/2025 06:31 AM (1 वर्ष पहले) |
|---|
| संयम | 19/07/2025 01:19 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 317010 [harry0703 MoneyPrinterTurbo तक 1.2.6 File Extension video.py upload_bgm_file अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|