CVE-2024-46441

Published September 27th, 2024

View on NVD ↗

CVSS v3

8.8

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php (called from app/admin/controller/ypay/Home.php). The file extension of an uncompressed file is not checked.

kacins/YPay

YPay是专为个人站长打造的聚合免签支付系统，拥有卓越的性能和丰富的功能。它采用全新轻量化的界面UI，让您能更方便快捷地解决知识付费和运营赞助的难题。同时，它基于高性能的ThinkPHP 6.1.4 + Layui2.9.9 + PearAdmin架构，提供实时监控和管理功能，让您随时随地掌握系统运营情况。

GitHub