-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability occurs in the file upload handler at /admin/api.upload/file. The PoC demonstrates attackers can manipulate the 'key' parameter (e.g., '.../1.zip') to perform directory traversal and upload malicious files. The function likely uses unsanitized user input from 'key' to determine file paths, combined with insufficient file type/content validation (allowing zip/ini files containing PHP code). This matches CWE-434 patterns where unsafe file types are processed without proper restrictions. The component path and attack pattern align with ThinkAdmin's structure and typical PHP controller implementations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zoujingli/thinkadmin | composer | <= 6.1.53 |