You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on May 8, 2023. It is now read-only.
Hello I want to report an arbitrary file upload vulnerability that I found in AeroCms v0.0.1, through which we can upload webshell and control the web server.
Step to Reproduct
After entering the background of website management, click "Profile" to enter the interface of "/admin/profile. PHP", and you can see that the function of uploading pictures exists.
We create a new webshell file and name it shell.php :
<?php phpinfo(); ?>
Next, we select the file and click "Updae Profile" to upload the file
When upload success access '/images/shell.php'
We can see that the file was successfully uploaded and executed
Hello I want to report an arbitrary file upload vulnerability that I found in AeroCms v0.0.1, through which we can upload webshell and control the web server.
Step to Reproduct
After entering the background of website management, click "Profile" to enter the interface of "/admin/profile. PHP", and you can see that the function of uploading pictures exists.
![image](https://user-images.githubusercontent.com/75592724/183818343-beeb7f38-f449-4198-8948-52ef97ba2e37.png)
We create a new webshell file and name it shell.php :
<?php phpinfo(); ?>
Next, we select the file and click "Updae Profile" to upload the file
![image](https://user-images.githubusercontent.com/75592724/183820040-86daedc7-efcb-44d6-ae03-f2384f9f43a5.png)
When upload success access '/images/shell.php'
We can see that the file was successfully uploaded and executed
Vulnerable Code
No file checking before uploading
POC
Injection Point
Request
response
I hope you can fix this vulnerability as soon as possible. I will report this vulnerability to CVE. Looking forward to your reply
The text was updated successfully, but these errors were encountered: