| शीर्षक | Tiandy Technologies Co., Ltd. Easy7 Integrated Management Platform 7.17.0 Unrestricted Upload of File with Dangerous Type |
|---|
| विवरण | Another critical unauthenticated file upload vulnerability was identified within the REST API architecture of the target product. The endpoint /rest/file/uploadLedImage contains a logical flaw that fails to verify the caller's identity. An attacker can exploit this to upload malicious JSP script files. Due to the lack of strict path restrictions, the attacker can plant a Webshell into the web directory, leading to Remote Code Execution (RCE) and full compromise of the target server. |
|---|
| स्रोत | ⚠️ https://my.feishu.cn/docx/Z5HJdLCxioFs4sxyILbcoSIAnTh?from=from_copylink |
|---|
| उपयोगकर्ता | 0menc (UID 75423) |
|---|
| सबमिशन | 03/03/2026 10:31 AM (7 महीनों पहले) |
|---|
| संयम | 15/03/2026 05:30 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 351145 [Tiandy Easy7 Integrated Management Platform 7.17.0 Endpoint uploadLedImage Arquivo अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|