Description
Free Host Shop Website Generator 3.3可使具有管理权限的远程认证用户借助formname参数(具有包含危险文件扩展名以及%00后缀的文件名)上传并执行任意文件。
FreeHostShop Website Generator任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://security.zone.ci/aliyun/ali_nonvd/292111.html
https://zone.ci/aliyun/ali_nvd/235904.html
https://nvd.nist.gov/vuln/detail/CVE-2006-0936
https://cve.imfht.com/detail/CVE-2006-0936?lang=en
https://github.com/advisories/GHSA-7m9f-4v5m-4qc7
https://avd.aliyun.com/product?prod=website_generator&page=-124