Unrestricted Upload Of File With Dangerous Type

2024-04-2607:32:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

unrestricted upload

dangerous file type

thinkcmf

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

thinkcmf/thinkcmf vulnerable to Unrestricted Upload of File with Dangerous Type. The vulnerability is due to insufficient validation of file extensions during the upload process in UeditorController.php. This flaw allows an attacker to execute arbitrary code via uploaded malicious files.

CPENameOperatorVersion
thinkcmf/thinkcmflev6.0.9
thinkcmf/thinkcmflev6.0.9

CPE	Name	Operator	Version
	thinkcmf/thinkcmf	le	v6.0.9
	thinkcmf/thinkcmf	le	v6.0.9

References

github.com/huajiuqi/bug/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md