Description
Badaso是一款Laravel headless CMS。CVE-2022-41711 中，攻击者可在无需登录的情况下上传任意文件，造成远程代码执行，控制服务器。
Badaso upload 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2022-41711
https://zone.ci/aliyun/ali_nvd/50417.html
https://security.snyk.io/vuln/SNYK-PHP-BADASOCORE-3063690
https://www.miggo.io/vulnerability-database/cve/CVE-2022-41711
https://github.com/advisories/GHSA-gqp9-jh35-439m
https://advisories.gitlab.com/composer/badaso/core/CVE-2025-52353/