CVE-2019-9842

CVE-2019-9842 affects madskristensen MiniBlog (through 2018-05-18). The root cause is in SaveFilesToDisk (app_code/handlers/PostHandler.cs), which writes a decoded base64 string to a file without validating the extension, enabling a remote attacker to execute arbitrary ASPX code via an IMG elemen...