HIGH8.8

GHSA-7gq9-p94f-g5v9

ThinkAdmin arbitrary file upload vulnerability

Details

An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/zoujingli/thinkadmin

Introduced in: 0

No fixed version published yet for zoujingli/thinkadmin (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-48966[ADVISORY]
https://github.com/1dreamGN/CVE/blob/main/ThinkAdmin%20directory%20traversal%2Bfile%20upload%20getshell.md[WEB]
https://github.com/zoujingli/ThinkAdmin[PACKAGE]