FUXA Unauthenticated Arbitrary File Upload Vulnerability in API Upload Endpoint

An unrestricted file upload vulnerability has been identified in FUXA version 1.2.7, specifically within the '/api/upload' API endpoint. This vulnerability arises because the endpoint lacks authentication, allowing unauthenticated remote attackers to upload arbitrary files. Exploitation of this vulnerability could lead to the overwriting of critical system files, such as the SQLite user database, potentially granting administrative access. Alternatively, attackers could upload malicious scripts to execute arbitrary code.

Impact

Successful exploitation allows for arbitrary file uploads, with the potential to overwrite critical system files or execute uploaded malicious scripts as arbitrary code.