漏洞描述 文件上传漏洞发生在应用程序允许用户上传文件的功能中,如果上传功能未能正确地验证和限制上传文件的类型和内容,攻击者可能利用此漏洞上传恶意文件,如包含可执行代码的脚本文件,从而在服务器上执行任意命令,控制或破坏系统。
相关漏洞推荐 POC CVE-2024-6220: WordPress Keydatas ≤ 2.5.2 - Arbitrary File Upload 月子会所ERP管理云平台 /Page/upload/UploadComponentHandler.ashx 文件上传漏洞 全程云 /OA/api/2.0/Common/AttachFile/UploadEditorFile 文件上传漏洞 POC CVE-2021-4449: ZoomSounds Plugin - Unauthenticated Arbitrary File Upload POC CVE-2021-4462: Employee Records System 1.0 - Unauthenticated File Upload RCE POC yonyou-u9-patchfile-upload: Yonyou U9 PatchFile.asmx - Unauthenticated Arbitrary File Upload 锐明技术Crocus系统 DeviceFileUpload.do 文件读取漏洞 新视窗新一代物业管理系统 /OfficeManagement/RegisterManager/Report/Training/Report/GetprintData.asmx SQL 注入漏洞 锐明技术 Crocus系统 DeviceFileUpload.do 任意文件读取漏洞 POC CVE-2017-17092: WordPress < 4.9.1 - Authenticated JavaScript File Upload POC CVE-2021-4449: ZoomSounds Plugin - Unauthenticated Arbitrary File Upload 锐明技术Crocus系统 DeviceFileUpload.do 任意文件读取漏洞 POC CVE-2025-64095: DNN - Unrestricted Arbitrary File Upload