| शीर्षक | lin-cms-tp5 1.0 Unrestricted Upload |
|---|
| विवरण | The file upload interface (POST /cms/file) provided by the CMS module has insufficient checks on the type/content of uploaded files, allowing anonymous users (frontend) to upload arbitrary files and save them to a publicly accessible directory (public/uploads). Attackers can upload files with arbitrary extensions, and if the server does not restrict execution or allows script execution in the upload directory, this could lead to serious consequences such as remote code execution (RCE), persistent backdoors, and information leakage. |
|---|
| स्रोत | ⚠️ https://github.com/ChenJinchuang/lin-cms-tp5/issues/65 |
|---|
| उपयोगकर्ता | formanagain (UID 93347) |
|---|
| सबमिशन | 11/12/2025 07:33 AM (10 महीनों पहले) |
|---|
| संयम | 27/12/2025 10:13 AM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338507 [ChenJinchuang Lin-CMS-TP5 तक 0.3.3 File Upload LocalUploader.php upload file अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|