| 제목 | JPShop JPShop <=1.5.02 Arbitrary file upload |
|---|
| 설명 | The JPShop e-commerce platform, version 1.5.02 and earlier, has a critical security vulnerability in its file upload feature. In the file "/api/controllers/common/UploadsController.php", the function "actionUpdate" accepts a parameter called "imgage" which can be manipulated to upload arbitrary files, including malicious PHP scripts. This can be exploited by an attacker to gain remote code execution capabilities on the server, posing a significant risk to the application's security. |
|---|
| 원천 | ⚠️ https://note.zhaoj.in/share/f8b2IX7GsZS5 |
|---|
| 사용자 | glzjin (UID 59815) |
|---|
| 제출 | 2024. 02. 05. AM 07:42 (3 연령 ago) |
|---|
| 모더레이션 | 2024. 02. 06. AM 09:29 (1 day later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 253003 [Juanpao JPShop 까지 1.5.02 UploadsController.php actionUpdate imgage 권한 상승] |
|---|
| 포인트들 | 20 |
|---|