Jakub Stankiewicz

The issue allows users to upload files of any type and extension without restriction in the Profile section of the Ready application. If the server is misconfigured, it can result in Remote Code Execution. This misconfiguration was present by default in installations from late 2021 and early 2022.

The issue arises from the improper neutralization of user input in a file search function within the invoices module, allowing for SQL Injection attacks. This can be exploited by a low-privileged user.

The issue allows a low-privileged user to provide a link to a local file using the `file://` protocol, enabling the attacker to read the content of the file. This can be used to read the content of system files.

A cross-site scripting (XSS) issue in the upload functionality of Ready File Explorer allows the injection of arbitrary JavaScript code in the filename. The injected content is stored on the server and is executed every time a user interacts with the uploaded file.