GitHub Advisoryadvisory · Packagist

GHSA-7gq9-p94f-g5v9 ThinkAdmin arbitrary file upload vulnerability

HIGH Published 2023-12-04 Modified 2023-12-08 Official page ↗
Aliases
CVE-2023-48966
Ecosystem
Packagist
Packages
zoujingli/thinkadmin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-12-08

Affected packages

• Packagist zoujingli/thinkadmin: <= 6.1.53 (no fix yet)

Description

An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file.

Related

Alias · CVE (1)

  • CVE-2023-48966 An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References