Lucene search

Veracode Vulnerability DatabaseVERACODE:41017

HistoryJun 26, 2023 - 9:55 a.m.

Arbitrary File Upload

2023-06-2609:55:50

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary file upload

vulnerability

file upload restrictions

malicious code

software security

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

25.9%

JSON

zoujingli/thinkadmin is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate files uploaded via api/upload.php, which allows an attacker to bypass the file upload restrictions and execute malicious code on the system.

CPENameOperatorVersion
zoujingli/thinkadminlev6.1.5
zoujingli/thinkadminlev6.1.5

CPE	Name	Operator	Version
	zoujingli/thinkadmin	le	v6.1.5
	zoujingli/thinkadmin	le	v6.1.5

References

github.com/advisories/GHSA-c49c-8c73-4w97

github.com/zoujingli/ThinkAdmin/blob/v6/app/admin/controller/api/Upload.php

note.youdao.com/s/3tge43wH

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

25.9%

JSON

Related for VERACODE:41017