Technical-Laohu Mpay Unrestricted File Upload Vulnerability in QR Code Image Handler

A vulnerability allowing arbitrary file uploads has been identified in Technical-Laohu Mpay versions through 1.2.4. The issue arises in the QR Code Image Handler component, where manipulation of the 'codeimg' argument enables unrestricted file uploads. This vulnerability can be exploited remotely, with public knowledge of the exploit available.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads, which could lead to the execution of malicious files on the server, such as web shells or viruses, potentially allowing attackers to gain control of the server or steal sensitive information.