Description
A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function this.fileService.download of the file com\llisoft\controller\OpenController.java. The manipulation of the argument url leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| llisoft | MTA Maita Training System | 4.5 | — |
References
- VDB-310259 | llisoft MTA Maita Training System OpenController.java this.fileService.download unrestricted upload vdb-entry technical-description
- VDB-310259 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #579088 | MTA Maita Training System v4.5 Arbitrary File Upload Vulnerability third-party-advisory
- https://wx.mail.qq.com/s?k=o3X5wV0ZZH0nuusQdO exploit