Unrestricted File Upload in Hanwang e-Face General Management Platform

Executive Summary

This vulnerability exists in the Hanwang e-Face General Management Platform version 6.3.5.4. It involves improper handling of the file upload process at the endpoint /manage/resourceUpload/upload.do. Specifically, manipulation of the 'File' argument can allow an attacker to upload files without restriction.

The vulnerability can be exploited remotely, meaning an attacker does not need local access to the system to launch an attack. The exploit has been publicly disclosed, increasing the risk of exploitation.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can allow an attacker to upload arbitrary files to the affected system without restriction. This could lead to unauthorized code execution, data compromise, or system takeover depending on the nature of the uploaded files.

Since the attack can be performed remotely and requires no authentication, it significantly increases the risk of unauthorized access and potential damage to the system.

Useful 0 Not Useful 0