Advisories

Soosyze 2.0.0 Unrestricted File Upload via Broken Upload Logic

Go Back
severity
medium
date
Affecting
  • Soosyze 2.0.0

CWE
  • CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS
6.9
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Credit
nu11secur1ty
Description
Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.