Cool-Admin-Java Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability allowing arbitrary file upload has been identified in Cool-Admin-Java version 1.0. This issue resides in the file upload component, specifically within the '/comm/upload' endpoint. Attackers can exploit this vulnerability by uploading a crafted file that is then executed on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Cool-Admin-Java is running.

Reproduction

To reproduce this vulnerability, access the '/api/admin/base/comm/upload' endpoint. After uploading a file through the interface, the uploaded file's path will be returned. Accessing this path will trigger the execution of the uploaded file, thereby exploiting the vulnerability.