VIAVIWEB Wallpaper Admin Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in VIAVIWEB Wallpaper Admin version 1.0. The issue arises from the image upload feature, which allows unauthenticated attackers to upload malicious PHP files through the add_gallery_image.php endpoint. Once uploaded, these files can execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server.

Reproduction

To reproduce this vulnerability, upload a malicious PHP file disguised as an image through the add_gallery_image.php endpoint. The uploaded file will be executed on the server.