cve/cves/2017/CVE-2017-7281.md at main

admin/cve

0 Fork 0

mirror of https://github.com/0xMarcio/cve.git synced 2026-10-23 16:35:19 +00:00

Files

T

0xMarcio f0e5b09dfb Fix PoC discovery scope and source attribution

2026-10-21 18:34:06 +02:00

965 B

Raw Permalink Blame History

CVE-2017-7281

Description

An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and saveReport functions in recoveryconsole/bpl/reports.php allows for an authenticated user to create a randomly named file on disk with a user-controlled extension, contents, and path, leading to remote code execution, aka Unrestricted File Upload.

POC

Reference

https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1/

Github

No PoCs found on GitHub currently.

Collections

https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2017-7281

965 B Raw Permalink Blame History