CVE-2023-50692

Name of the Vulnerable Software and Affected Versions JIZHICMS version 2.5

Description The issue allows a remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download url parameter in the app/admin/exts/ directory. This enables the attacker to potentially gain control over the system.

Recommendations For JIZHICMS version 2.5, as a temporary workaround, consider disabling the file upload functionality in the app/admin/exts/ directory until a patch is available. Restrict access to the download url parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.