NewType Infortech NUP Portal Missing Authentication Vulnerability Allowing Unauthenticated File Upload

A missing authentication vulnerability has been identified in the NUP Portal developed by NewType Infortech, affecting versions SP5.0 and prior. This vulnerability allows unauthenticated remote attackers to directly upload files. If an attacker can bypass the file extension restrictions, they could upload a web shell and execute it on the server side.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, with the potential for uploaded files to be executed on the server, such as web shells that allow remote code execution.

Remediation

Users are advised to update to version SP5.1 or later.