| शीर्षक | Badaso 2.9.13 Unrestricted Upload |
|---|
| विवरण | ## Vulnerability Files:
| File | Function/Line | Issue |
| ------------------------------------------ | --------------------------------- | ---------------------------------------------- |
| `src/Traits/FileHandler.php` | `handleUploadFiles()` Lines 11-42 | No file extension validation |
| `src/Controllers/BadasoFileController.php` | `uploadFile()` Lines 13-18 | Directly calls vulnerable handler |
| `src/Routes/api.php` | Line 53 | Exposes upload endpoint to authenticated users |
---
## Description:
A critical arbitrary file upload vulnerability exists in Badaso 2.9.13. The `handleUploadFiles()` function in the `FileHandler` trait accepts base64-encoded files and saves them directly to the public storage directory without validating the file extension or MIME type. This allows authenticated attackers to upload malicious PHP files and achieve Remote Code Execution (RCE) on the server.
While the frontend File Manager (LFM) implements MIME type validation, the backend API endpoint `/badaso-api/v1/file/upload` can be called directly, bypassing all frontend restrictions. |
|---|
| स्रोत | ⚠️ https://note-hxlab.wetolink.com/share/y7SBC02iMBKk |
|---|
| उपयोगकर्ता | hiro (UID 93548) |
|---|
| सबमिशन | 20/12/2025 04:02 AM (10 महीनों पहले) |
|---|
| संयम | 31/12/2025 03:48 PM (11 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 321491 [Badaso CMS 2.9.11 Media Manager अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|