Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxedu.os.common.controller.VideoUploadController#gok4 (com/inxedu/os/common/controller/VideoUploadController.java). The attacker uses the /video/uploadvideo fileType parameter to change the list of acceptable extensions from jpg,gif,png,jpeg to jpg,gif,png,jsp,jpeg.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
inxedu 安全漏洞
Vulnerability Description
inxedu是中国因酷时代（inxedu）公司的一套开源的在线教育平台。该平台包括网校系统、直播系统、考试系统和营销官网等。 inxedu 2018-12-24及之前版本中com.inxedu.os.common.controller.VideoUploadController#gok4存在安全漏洞。攻击者可借助‘fileType’参数利用该漏洞将可接受的文件类型从jpg、gif、png、jpeg更改成jpg、gif、png、jsp、jpeg。
CVSS Information
N/A
Vulnerability Type
N/A