| शीर्षक | XCMS 1.0 Unrestricted Upload |
|---|
| विवरण | XCMS's front-end file upload interface lacks strict validation of uploaded file type, content, and file extension. Attackers can upload malicious files of any format (such as PHP webshells) without logging in. After a successful upload, the file can be accessed and executed directly via an HTTP request, ultimately leading to remote code execution. |
|---|
| स्रोत | ⚠️ https://gitee.com/jackq/XCMS/issues/IDC4ZT |
|---|
| उपयोगकर्ता | formanagain (UID 93347) |
|---|
| सबमिशन | 10/12/2025 09:12 AM (10 महीनों पहले) |
|---|
| संयम | 27/12/2025 12:14 AM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338480 [jackq XCMS तक 3fab5342cc509945a7ce1b8ec39d19f701b89261 upload.php अधिकार वृद्धि] |
|---|
| अंक | 18 |
|---|