POJIA破甲
地图 / Unrestricted file upload vulnerability in IMCE

Unrestricted file upload vulnerability in IMCE

代码执行 / 远程文件包含 / #1121317

厂商
Acronis
严重程度
低危
赏金
—
弱点
远程文件包含
研究员
@bughunter_h1_bughunter
披露日期
2021-03-16
资产
*.acronis.com
CVE
CVE-2006-7109

该报告还没有中文解读。

原文摘录

摘自原文(476 字符中的一小部分)
Steps To Reproduce POC 1. Go to "https://forum.acronis.com/" and creat user 1. Click on edit profile and go to Signature click on (inser image usig imce file manger) 1. Now upload php file and bypass to add .gif in the endpoint

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Acronis 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @bughunter_h1_bughunter · 版权归作者与 Acronis 所有

同类报告

[CVE-2022-44268] Arbitrary Remote Leak via ImageMagickHackerOne · 2023-03-16SSRF & LFR via on city-mobil.ruMail.ru · —Keybase client (Windows 10): Write files anywhere in userland using relative path in "download attachement" featureKeybase · — · $5,000Payload delivery via Social Media urls on H1 profileHackerOne · 2024-07-23Grafana LFI on https://grafana.mariadb.orgMariaDB · 2022-01-06LFI with potential to RCE on ██████ using CVE-2019-3396U.S. Dept Of Defense · 2019-10-04