| शीर्षक | light0011 cms f72cf46f601efb2a0618c3814cc2f61380b38930 Unrestricted Upload |
|---|
| विवरण | `App/Home/Controller/UserController.class.php:60-74`, `App/Admin/Controller/ChapterController.class.php:57-70`, and `App/Admin/Controller/AdController.class.php:43-56` instantiate `Think\Upload`, set only `rootPath`, and call `upload()`. `ThinkPHP/Library/Think/Upload.class.php:17-31` defaults `mimes` and `exts` to empty arrays and `maxSize` to zero; its checks at lines 285-305 and 342-360 consequently permit every extension, MIME type, and size. The Home endpoint is public, and the two Admin endpoints are also unauthenticated because their controllers omit `AuthController`. The committed SAE driver configuration makes arbitrary object upload the confirmed impact. In a Local-driver deployment where `./image/` is web-served and PHP-executable, the same flaw additionally permits remote PHP code execution; that conditional behavior was reproduced in the isolated test deployment.
|
|---|
| स्रोत | ⚠️ https://github.com/light0011/cms/issues/9 |
|---|
| उपयोगकर्ता | JiuZer0 (UID 99525) |
|---|
| सबमिशन | 18/07/2026 07:57 AM (2 महीनों पहले) |
|---|
| संयम | 06/09/2026 08:11 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 399478 [light0011 cms Upload.class.php Upload::upload अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|