漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)
Vulnerability Description
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload` endpoint lets admins upload any file to `plugins/payment/`. It only checks a hardcoded password (`qweasd123456`) and ignores file content. A background watcher (`StartWatcher`) then scans this folder every 5 seconds. If it finds a new executable, it runs it immediately, resulting in RCE. Version 4.0.0 fixes the issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
危险类型文件的不加限制上传
Vulnerability Title
xiaoheiFS 安全漏洞
Vulnerability Description
xiaoheiFS是Danvei个人开发者的一个自托管云服务财务与运营系统。 xiaoheiFS 0.3.15及之前版本存在安全漏洞，该漏洞源于AdminPaymentPluginUpload端点允许管理员上传任意文件至plugins/payment/目录，后台监视器会扫描并立即执行新发现的可执行文件，可能导致远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A