An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl URI.
Weakness
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ofcms | Ofcms_project | * | 1.1.3 (excluding) |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/159.html
- https://cwe.mitre.org/data/definitions/177.html
- https://cwe.mitre.org/data/definitions/48.html
- https://cwe.mitre.org/data/definitions/641.html