InnovaStudio WYSIWYG Editor Unrestricted File Upload Vulnerability

A vulnerability allowing unrestricted file upload has been identified in InnovaStudio WYSIWYG Editor version 5.4. This issue arises from the asset manager's failure to properly enforce file extension restrictions, allowing attackers to manipulate filenames and exploit null byte techniques to upload malicious ASP shell files. The vulnerability is present on Windows 10 and Windows Server 2019.

Impact

Exploitation of this vulnerability allows for unrestricted file upload, which can lead to the execution of malicious ASP shell files on the server.

Reproduction

The vulnerability can be reproduced by uploading a file through the asset manager while manipulating the filename to include a null byte and an alternate file extension. This bypasses the application's file type restrictions and allows the upload of malicious ASP shell files.