Tiandy Video Surveillance System Unrestricted File Upload Vulnerability in Version 7.17.0

A vulnerability allowing unrestricted file uploads has been identified in Tiandy Video Surveillance System version 7.17.0. The issue arises in the 'uploadFile' function within 'CLS_REST_File.java', where the 'fileName' argument is not properly validated. This lack of validation enables attackers to upload files of any type, such as JSP, EXE, or shell scripts. If the uploaded file is placed in a directory accessible via the web, and the server allows execution of such files, this could lead to remote code execution by uploading a web shell and executing it through a URL.

Impact

Exploitation of this vulnerability could result in unauthorized file uploads, potentially leading to remote code execution if the uploaded file is executed by the server.