The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP file first and then exploit this vulnerability to include the file, resulting in arbitrary code execution on the server.
Solution:
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
| Link | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-8144-2885b-1.html | third party advisory |
| https://www.twcert.org.tw/en/cp-139-8145-15bea-2.html | third party advisory |