Verytops Verydows Insecure Permissions Vulnerability Allowing Arbitrary Code Execution

A vulnerability in Verytops Verydows version 2.0 allows remote attackers to execute arbitrary code by uploading files with certain extensions. The issue arises from improper permission settings in the application.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Verydows is installed.

Reproduction

To reproduce this vulnerability, log into the backend of the Verytops Verydows application. Once logged in, navigate to the product image upload interface. Upload a file with a PHP file extension, which will be accepted due to the insecure permission settings. After the file is uploaded, it can be executed, leading to code execution on the server.