关键信息 Product Information: - Vendor Homepage: https://www.bdtask.com - Software Link: https://codecanyon.net/item/news365-php-newspaper-magazine-blog-php-script-with-video-newspaper/19015501 - Affected Version: Version 7.0.3 Vulnerability Details: - Type: Unrestricted File Upload leading to Remote Code Execution (RCE) - Affected URL: https://latestnews365.bdtask-demo.com/admin/dashboard/profile - Vulnerable Parameter: profile_image and banner_image (File Upload) - Vulnerable Component: News365 – PHP Newspaper Script Magazine Blog with Video Newspaper admin panel. Vulnerability Type: - Unrestricted Upload of File with Dangerous Type - CWE ID: CWE-434 - Severity Level: CRITICAL - CVSS Score: 9.8 (Critical) Root Cause: - The application's file upload functionality within the admin panel's profile management section fails to properly validate the extension or content type of user-submitted files. Proof of Concept (PoC): - Steps to log in to the admin panel, navigate to dashboard > profile, upload a malicious .php file, and execute a command. Impact: - Full Server Compromise - Data Breach - Website Defacement - Internal Network Pivot Suggested Remediation: - Use a strict whitelist for file extensions - Validate MIME type and file content - Store uploaded files outside the webroot - Rename uploaded files