GHSA-vgxq-6rcf-qwrw
angular-base64-upload vulnerable to unauthenticated remote code execution
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | angular-base64-upload | < 0.1.21 | 0.1.21 |
Details
As written in the advisory (Markdown source, shown as plain text).
angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the `angular-base64-upload/demo/server.php` endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the `angular-base64-upload/demo/uploads` endpoint. This leads to the execution of previously uploaded content which enables the attacker to achieve code execution on the server.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
References
External links from the advisory. They lead to third-party sites.