Description
An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUNNET Technology | Corporate Training Management System | ≤ v.10.3 | — |
References
- https://zuso.ai/advisory third-party-advisory