CVE-2018-17058

An issue was discovered in JABA XPress Online Shop through 2018-09-14. It contains an arbitrary file upload vulnerability in the picture-upload feature of ProductEdit.aspx. An authenticated attacker may bypass the frontend filename validation and upload an arbitrary file via FileUploader.aspx.cs ...

CVE-2018-17058

An issue was discovered in JABA XPress Online Shop through 2018-09-14. It contains an arbitrary file upload vulnerability in the picture-upload feature of ProductEdit.aspx. An authenticated attacker may bypass the frontend filename validation and upload an arbitrary file via FileUploader.aspx.cs ...

CVE-2018-17058

The CVE-2018-17058 issue affects JABA XPress Online Shop (ProductEdit.aspx picture-upload feature). An authenticated attacker can bypass frontend filename validation in FileUploader.aspx.cs by supplying empty width/height parameters, enabling arbitrary file uploads via FileUploader.aspx. The uplo...