| शीर्षक | Acrel Electric Co., Ltd. EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 Unrestricted File Upload |
|---|
| विवरण | A Critical vulnerability exists in the Acrel EEMS Enterprise Power Operation and Maintenance Cloud Platform. The /SubstationWEBV2/app/..;/main/upfile interface fails to perform proper Identity Authentication and File Validation.
By leveraging a URL normalization bypass (..;) and Directory Traversal in the path parameter, an unauthenticated remote attacker can upload arbitrary malicious files (such as .jsp webshells) to any sensitive directory within the web root. This lead to a complete system compromise and Remote Code Execution (RCE) under the privileges of the web service user. |
|---|
| स्रोत | ⚠️ https://ucn9h68n9289.feishu.cn/wiki/FC6swHuyqiLVyfkwKcNc8sCjnfb |
|---|
| उपयोगकर्ता | bigbrother_man (UID 96003) |
|---|
| सबमिशन | 29/04/2026 04:03 AM (1 महीना पहले) |
|---|
| संयम | 26/05/2026 09:14 AM (27 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 365609 [Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform upfile निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|