OFCMS backend ueditor uploadImage file upload vulnerability

OFCMS is a content management system developed based on java technology. There is a file upload vulnerability in OFCMS backend ueditor uploadImage, which can be exploited by attackers to upload webshell and gain server privileges, posing information leakage and operational security risks...

PT-2019-19747

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue allows remote attackers to execute arbitrary code. The blocking of .jsp and .jspx files does not consider certain file extensions, such as file.jsp::$DATA, when accessing the...

CVE-2019-9608: Unrestricted Upload of File with Dangerous Type

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadImage URI...