LandChat Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in LandChat version 3.25.12.18. This vulnerability allows an unauthenticated attacker to execute system code remotely via network access.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Reproduction

To reproduce this vulnerability, send a request to the '/upload/web/utb_res.php' endpoint with a payload that includes a command to be executed, such as a curl command that sends data to a remote server. The command will be executed on the server, allowing for remote code execution.