StarSea99 Starsea-Mall Unrestricted File Upload Vulnerability in UploadController

A critical vulnerability exists in StarSea99's starsea-mall version 1.0, specifically within the UploadController function of the file src/main/java/com/siro/mall/controller/common/uploadController.java. This vulnerability allows for unrestricted file uploads, as the upload method does not properly validate the types of files being uploaded. Attackers can exploit this issue remotely by uploading JSP and HTML files, potentially leading to further exploitation.

Impact

Exploitation of this vulnerability allows for unrestricted file uploads, which could be used to upload malicious files that are executed on the server.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the admin upload file endpoint. Once there, upload a file with a .jsp or .html extension. The server will accept the file without any restrictions.