Description
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| elunez | eladmin | ≤ 2.7 | — |
References
- Researcher Proof of Concept exploit
- Vulnerable Code (2.7) technical-description
- VulnCheck Advisory: Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload third-party-advisory