| タイトル | Great Developers Certificate Generator System 1.0 Unrestricted Upload |
|---|
| 説明 | An Arbitrary File Upload vulnerability (CWE-434) exists in the CSV upload functionality. The application validates uploaded files solely based on the file extension and concatenates the original filename directly into the destination path. This validation can be trivially bypassed by supplying a crafted filename such as payload.csv.php. No MIME type validation, file size restriction, or content inspection is performed. Uploaded files are stored in a web-accessible directory, enabling potential execution of malicious scripts if server-side execution is permitted. |
|---|
| ソース | ⚠️ https://github.com/lakshayyverma/CVE-Discovery/blob/main/Certificate.md |
|---|
| ユーザー | lakshay12311 (UID 91298) |
|---|
| 送信 | 2026年01月31日 11:22 (3 月 ago) |
|---|
| モデレーション | 2026年02月07日 16:27 (7 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 344886 [Great Developers Certificate Generation System 迄 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73 /restructured/csv.php 特権昇格] |
|---|
| ポイント | 20 |
|---|