| tiêu đề | SourceCodester Student Management System 1.0 Unrestricted Upload |
|---|
| Mô tả | The input obtained through doupdateimage in line 132 of the admin\user\controller.php file is used by doupdateimage in line 151 of the admin\user\controller.php file to determine the location of the file to be written, which may allow attackers to change or damage the content of the file, or create a completely new file.
Tiki found that the file upload operation was triggered in /add-students.php, and the _FAILE variable was used to receive the payload. After receiving the attack vector from a remote attacker, it will result in unrestricted uploads, and remote attacks may lead to RCE. |
|---|
| Nguồn | ⚠️ https://github.com/Charlotte008/cve/issues/1 |
|---|
| Người dùng | Tiki (UID 70996) |
|---|
| Đệ trình | 01/07/2024 13:32 (cách đây 2 những năm) |
|---|
| Kiểm duyệt | 02/07/2024 07:10 (18 hours later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 264744 [SourceCodester Student Management System 1.0 /student/controller.php photo nâng cao đặc quyền] |
|---|
| điểm | 0 |
|---|