Panhainan DS-Java Code Injection Vulnerability via File Upload

A critical code injection vulnerability has been identified in Panhainan DS-Java version 1.0. The issue arises in the 'uploadUserPic.action' function within 'src/com/phn/action/FileUpload.java', where improper handling of the 'fileUpload' argument allows for arbitrary file uploads. This vulnerability can be exploited remotely by uploading malicious JSP files, which could then be executed on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, with the uploaded JSP file being executed as code.