Metasoft MetaCRM Unrestricted File Upload Vulnerability

A vulnerability allowing unauthorized file uploads has been identified in Metasoft MetaCRM version 6.4.0. The issue arises in an unknown function of the file develop/systparam/softlogo/upload.jsp, where unrestricted file upload capabilities are present. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for unauthorized file uploads, which could lead to further attacks such as web shell execution or uploading malicious files that could be executed by the application.

Reproduction

To reproduce this vulnerability, upload a file through the develop/systparam/softlogo/upload.jsp endpoint. The upload request can be made using a POST method, including a file such as a JSP shell that could be executed on the server.