Digiwin ERP Unrestricted File Upload Vulnerability in UploadAjaxAPI.ashx

A critical vulnerability allowing unrestricted file uploads has been identified in Digiwin ERP version 5.0.1. The issue arises in the file '/Api/TinyMce/UploadAjaxAPI.ashx', where manipulation of the 'File' argument enables unauthorized file uploads. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for unrestricted file uploads, which could lead to various security issues depending on the nature of the uploaded files.

Reproduction

To reproduce this vulnerability, send a request to the '/Api/TinyMce/UploadAjaxAPI.ashx' endpoint with a manipulated 'File' argument that includes the desired file for upload. The absence of proper validation on the file upload process allows for unrestricted file types and sizes to be uploaded.