| 标题 | Storage Unit Rental Management System v1.0 /storage/classes/Users.php?f=save post form-data parameter filename exists arbitrary file upload |
|---|
| 描述 | Storage Unit Rental Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /storage/classes/Users.php?f=save post form-data parameter 'filename'. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Steps to reproduce
1.Go to the admin Dashboard
2.Click on User List and Click on +Create New
3.Any file can be uploaded, such as uploading php code
4.Access to uploaded files can be executed successfully |
|---|
| 来源 | ⚠️ https://github.com/ret2hh/bug_report/blob/main/UPLOAD.md |
|---|
| 用户 | bit3hh (UID 42576) |
|---|
| 提交 | 2023-03-20 10時38分 (4 年前) |
|---|
| 管理 | 2023-03-22 11時03分 (2 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 223552 [SourceCodester Storage Unit Rental Management System 1.0 classes/Users.php?f=save 权限提升] |
|---|
| 积分 | 20 |
|---|