| tiêu đề | Rongzhitong Technology (Beijing) Co., Ltd. Rongzhitong Dispatch Platform (调度平台) Latest version Unrestricted Upload of File with Dangerous Type |
|---|
| Mô tả | A Critical unauthenticated arbitrary file upload vulnerability has been identified in the Rongzhitong Dispatch Platform developed by Rongzhitong Technology (Beijing) Co., Ltd.
The vulnerability exists in the /dm/dispatch/userinfo/upload interface. The upload endpoint does not properly authenticate the request or validate the type, extension, or content of the uploaded file, allowing a remote attacker to upload arbitrary files (including server-side script files such as .jsp) without any authentication.
Successful exploitation may allow an unauthenticated attacker to upload a web shell, achieve remote code execution on the underlying server, take full control of the application, pivot into the internal network, and access or tamper with sensitive business data. This may further affect the confidentiality, integrity, and availability of the dispatch platform. |
|---|
| Nguồn | ⚠️ https://ucn9h68n9289.feishu.cn/wiki/CVIpwknSYiQXejkvw7McPrs1n2g?from=from_copylink |
|---|
| Người dùng | Anonymous User |
|---|
| Đệ trình | 17/06/2026 04:18 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 05/08/2026 17:54 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 386260 [Rongzhitong Visual Integrated Command and Dispatch Platform đến 20260617 upload Tệp tin nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|