Beveiligingsadvies

CVE-2025-46191

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2025-05-09 00:00:00

Laatst bijgewerkt 2025-05-10 01:57:45

Toegewezen door mitre

CVSS-score 9.8

Status PUBLISHED

Beschrijving

Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploaded_file_cancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attackers can upload executable PHP files to a web-accessible directory (/files/). This allows them to execute arbitrary commands remotely by accessing the uploaded script, resulting in full Remote Code Execution (RCE) without authentication.

← Alle CVE's bekijken Bekijk op cve.org ↗