CyberRota Analysis
AI-GeneratedThe vulnerability in the FileController::upload function of hcr707305003 shiroiAdmin versions 1.1 and 1.3 allows for unrestricted file uploads, potentially enabling remote attackers to execute arbitrary code on the server. Organizations using these affected versions should prioritize upgrading to version 1.4, as the exploit has been publicly disclosed and is actively exploitable. Immediate action is recommended to mitigate the risk of unauthorized access and data compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.4 is able to address this issue. This patch is called 3ecde28ea8a20a3840dbfefd6d6863ee79a83e70. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.