| शीर्षक | OpenWGA OpenWGA Admin Client 7.11.12 (Build 737) Code Injection |
|---|
| विवरण | OpenWGA Admin Client exposes TMLScript APIs that allow file I/O via WGA.File. In the tested build, a user with Admin or Design rights can write attacker-controlled files into a web-served path. Writing a server-interpreted artefact (for example a .jsp) into the OpenWGA webroot and then requesting it over HTTP results in remote code execution under the application server account.
This combines insufficient restriction of TMLScript file writes with a webroot that is writable and executed by the servlet container. |
|---|
| स्रोत | ⚠️ https://github.com/mikecole-mg/security_findings/blob/main/openwga/openwga-rce.md |
|---|
| उपयोगकर्ता | mikecole-mg (UID 89343) |
|---|
| सबमिशन | 13/10/2025 12:35 AM (12 महीनों पहले) |
|---|
| संयम | 26/10/2025 06:29 AM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 329921 [OpenWGA 7.11.12 Build 737 TMLScript API WGA.File निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|