CVE-2018-17058

The CVE-2018-17058 issue affects JABA XPress Online Shop (ProductEdit.aspx picture-upload feature). An authenticated attacker can bypass frontend filename validation in FileUploader.aspx.cs by supplying empty width/height parameters, enabling arbitrary file uploads via FileUploader.aspx. The uplo...