PT-2023-17021 · Xzjie Cms · Xzjie Cms
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
xzjie cms versions up to 1.0.3
Description
A critical issue affects the processing of the file "/api/upload". The manipulation of the
uploadFile argument leads to unrestricted upload. The attack can be initiated remotely.Recommendations
For versions up to 1.0.3, consider disabling the upload functionality via the "/api/upload" endpoint until a patch is available. Restrict access to the
uploadFile argument to minimize the risk of exploitation.Exploit
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Xzjie Cms