kalcaddle kodbox Public Share userShare.class.php add privilege escalation

A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/explorer/userShare.class.php of the component Public Share Handler. Such manipulation leads to unrestricted upload. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

危险类型文件的不加限制上传

Kalcaddle Kodbox 代码问题漏洞

Kalcaddle Kodbox是中国可道云（Kalcaddle）公司的一个私有云存储与在线协同办公平台。 kalcaddle kodbox 1.64版本存在代码问题漏洞，该漏洞源于对文件app/controller/explorer/userShare.class.php中Add函数的操作导致上传不受限制，可能导致任意文件上传。

N/A

N/A