CVE-2024-13210

Name of the Vulnerable Software and Affected Versions donglight bookstore电商书城系统说明 version 1.0

Description A critical issue has been found in the uploadPicture function of the AdminBookController class, located in the file src/main/java/org/zdd/bookstore/web/controller/admin/AdminBookController.java. The manipulation of the pictureFile argument leads to unrestricted upload. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used.

Recommendations For version 1.0, as a temporary workaround, consider disabling the uploadPicture function until a patch is available. Restrict access to the pictureFile argument in the uploadPicture function to minimize the risk of exploitation.