IYaow PR6licb C3kdw3xc Jp Q7n6b
[★]U+Smart Enjoyment WebSite—/Report/Upload/UploadFormImg.ashx—Unauthorized File Upload Vulnerability
U+Smart Enjoyment WebSite—/Report/Upload/UploadFormImg.ashx—Unauthorized File Upload Vulnerability
Company：Beijing Meite Software Technology Co., Ltd.
: CWE-434 (Unrestricted Upload of File with Dangerous Type)
The /Report/Upload/UploadFormImg.ashx interface of the U+ Smart Enjoyment system developed by Chengdu Youjia Changjie Technology Co., Ltd. exhibits a file upload vulnerability. This vulnerability arises from
the system's failure to conduct comprehensive type verification, extension name checking, and content filtering before storing user-uploaded files on the server
. Attackers can exploit this vulnerability by uploading maliciously crafted files (such as ashx files containing malicious software) to persistently store executable scripts on the server. When other users access the file or the server processes and executes the file, risks such as
remote code execution, server takeover, sensitive data leakage, website tampering, or further internal network penetration may occur.
This vulnerability widely affects the U+智享版 system. Attackers can use network security mapping tools such as Hunter to and query web. body="U+智享版" to obtain a large number of global public network targets using the system.
Unauthorized file upload path found: /Report/Upload/UploadFormImg.ashx，The prompt request type is empty.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
