OFCMS backend ueditor uploadFile file upload vulnerability

OFCMS is a content management system based on Java technology. A backend ueditor uploadFile file upload vulnerability exists in versions of OFCMS prior to 1.1.3. The vulnerability stems from the blocking of .jsp and .jspx files that fails to take into account file.jsp::$DATA of the...

PT-2019-19756

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue allows remote attackers to execute arbitrary code. The blocking of .jsp and .jspx files does not consider certain file extensions, such as file.jsp::$DATA, when accessing the...

CVE-2019-9617: Unrestricted Upload of File with Dangerous Type

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadFile URI...