| शीर्षक | Harvard University Dataverse Project 6.8 build 1994-92d1ec8 Unrestricted Upload |
|---|
| विवरण | Description
A Critical vulnerability exists in the DataVerse theme customization feature. The application fails to properly validate file uploads on the server side. While the client-side interface restricts uploads to .jpg or .png extensions, this control is easily bypassed by intercepting the HTTP request and modifying the filename and content.
Impact
Successful exploitation allows an attacker to upload and execute arbitrary Java server pages (JSP). This leads to Remote Code Execution (RCE) under the context of the web server user. |
|---|
| स्रोत | ⚠️ https://gist.github.com/KaiqueFerreiraPeres/ba039887d7f894a7c38252314e0ef2cc |
|---|
| उपयोगकर्ता | JustF0rFun (UID 94359) |
|---|
| सबमिशन | 29/01/2026 07:28 PM (8 महीनों पहले) |
|---|
| संयम | 01/04/2026 11:17 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 354616 [Harvard University IQSS Dataverse तक 6.8 Theme Customization /ThemeAndWidgets.xhtml uploadLogo अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|