| タイトル | JPShop JPShop <=1.5.02 Arbitrary file upload |
|---|
| 説明 | The JPShop e-commerce platform, version 1.5.02 and earlier, has a critical security vulnerability in its file upload feature. In the file "/api/controllers/common/UploadsController.php", the function "actionUpdate" accepts a parameter called "imgage" which can be manipulated to upload arbitrary files, including malicious PHP scripts. This can be exploited by an attacker to gain remote code execution capabilities on the server, posing a significant risk to the application's security. |
|---|
| ソース | ⚠️ https://note.zhaoj.in/share/f8b2IX7GsZS5 |
|---|
| ユーザー | glzjin (UID 59815) |
|---|
| 送信 | 2024年02月05日 07:42 (3 年 ago) |
|---|
| モデレーション | 2024年02月06日 09:29 (1 day later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 253003 [Juanpao JPShop 迄 1.5.02 UploadsController.php actionUpdate imgage 特権昇格] |
|---|
| ポイント | 20 |
|---|