Gouguoa
Monthly
Unrestricted file upload in GouGuOA through 6.1.2 lets an authenticated low-privilege user bypass upload extension restrictions and place a file of their choosing on the server through the disk module's chunkUpload API (app/disk/controller/Api.php). The CVSS 4.0 base score is 5.3 with PR:L and E:P, while the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact once an account is held; no user interaction is needed. A public PoC reference exists in the form of a GitHub-hosted vulnerability report; it is not verified as working exploit code, and there is no KEV listing indicating active exploitation. The vendor was contacted and did not respond, so no fixed version has been published.
Unrestricted file upload in GouGuOA through 6.1.2 lets an authenticated low-privilege user bypass upload extension restrictions and place a file of their choosing on the server through the disk module's chunkUpload API (app/disk/controller/Api.php). The CVSS 4.0 base score is 5.3 with PR:L and E:P, while the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact once an account is held; no user interaction is needed. A public PoC reference exists in the form of a GitHub-hosted vulnerability report; it is not verified as working exploit code, and there is no KEV listing indicating active exploitation. The vendor was contacted and did not respond, so no fixed version has been published.