| शीर्षक | BiggiDroid Simple PHP CMS 1.0 Unrestricted Upload |
|---|
| विवरण | The Simple PHP Blog CMS is vulnerable to an unrestricted arbitrary file upload vulnerability in the admin panel’s Site Logo update functionality. The application fails to properly validate uploaded files, allowing attackers to upload malicious PHP files instead of legitimate image files.
Uploaded files are stored in a web-accessible directory with no restriction on file type, extension, or MIME validation. Because the upload directory permits PHP execution, an attacker can directly access the uploaded file via a browser and execute arbitrary system commands.
Successful exploitation results in remote code execution (RCE) on the underlying server, potentially leading to full system compromise, data theft, persistence installation, or service disruption.
This issue occurs due to missing server-side validation, unsafe handling of user-controlled filenames, and lack of execution restrictions on uploaded content. |
|---|
| स्रोत | ⚠️ https://github.com/Asim-QAZi/RCE-Simplephpblog-biggiedroid |
|---|
| उपयोगकर्ता | moasim (UID 93970) |
|---|
| सबमिशन | 29/12/2025 07:36 PM (9 महीनों पहले) |
|---|
| संयम | 09/01/2026 12:37 PM (11 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 340273 [BiggiDroid Simple PHP CMS 1.0 /admin/editsite.php image अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|