| Название | DedeBIZ DedeBIZ <=6.2.12 file upload |
|---|
| Описание | When logging into the backend as an administrator, we can upload files in the attachment management section. Here, we can upload files, and the backend likely detects whether the uploaded file is an image based on its file signature. However, this means we can upload arbitrary PHP files, potentially leading to command execution. |
|---|
| Источник | ⚠️ https://github.com/JTZ-a/SRC/blob/master/DedeBIZ/DedeBIZ%20-%20file%20upload/README.md |
|---|
| Пользователь | JTZ- (UID 59232) |
|---|
| Представление | 20.12.2023 06:25 (3 лет назад) |
|---|
| Модерация | 29.12.2023 23:20 (10 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 249368 [Muyun DedeBIZ до 6.2.12 Add Attachment эскалация привилегий] |
|---|
| Баллы | 18 |
|---|