关键漏洞信息 漏洞标题 Unrestricted File Upload in Bdtask Flight Booking Software B2B Portal v4 漏洞类型 Unrestricted File Upload leading to Remote Code Execution (RCE) 影响URL https://subah.bdtask-demo.com/subah_v4/agent/profile/edit 漏洞参数 Multiple Image Upload Parameters (e.g., Owner image, Owner nid image, Trade licence copy, Civil aviation no, etc.) 漏洞组件 Multiple image upload functionalities on the agent profile edit page, and generally across various image upload parameters in subah_v4 and earlier versions (with some exceptions). 漏洞级别 CVSS Score: 9.8 (Critical) Severity Level: CRITICAL 根因 The application's file upload functionality within the B2B portal's image upload modules fails to properly validate the extension or MIME type of user-submitted files. 影响 Full Server Compromise Data Breach Website Defacement Internal Network Pivot 描述 An authenticated user in the B2B portal can access their profile edit page and upload a malicious file through vulnerable form fields. 攻击向量 The attacker uploads a PHP script via image upload forms and accesses the direct URL for RCE. 攻击载荷示例 Create and upload a file named with the PHP shell content. 证明概念 (PoC) Available at the provided video link. 建议修复 Use a strict whitelist for safe file extensions. Validate MIME type server-side. Store uploaded files outside the webroot. Rename uploaded files to a random, non-executable name. 参考 OWASP Unrestricted File Upload CWE-434: Unrestricted Upload of File with Dangerous Type