Yue Lao Blind Box Unrestricted File Upload Vulnerability in Upload.php

A critical unrestricted file upload vulnerability has been identified in Yue Lao Blind Box versions through 4.0. The issue arises in the 'base64image' function within 'Upload.php', where the 'data' argument can be manipulated to upload files without restriction. This vulnerability can be exploited remotely, and details of the exploit are publicly available.

Impact

Exploitation of this vulnerability allows for unrestricted file uploads, which could lead to the execution of malicious files on the server.

Reproduction

The vulnerability can be reproduced by encoding a file, such as a PHP script, in Base64 and uploading it through the application's file upload feature. The 'data' parameter, which is an array, is processed by the 'base64image' function. The uploaded file is saved without proper validation of its type or extension, allowing potentially harmful files to be executed on the server.