Description
angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content to the server, which can subsequently accessed through the angular-base64-upload/demo/uploads endpoint.
Recommendation
Update the angular-base64-upload package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.1.21
- Patched version(s): 0.1.21
References
Could your website be exposed too?
SmartScanner can check your website for angular-base64-upload vulnerable to unauthenticated remote code execution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal - CVE-2024-47169
- Angular Expressions - Remote Code Execution when using locals - CVE-2024-54152
- Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362
- Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
You might also like:
See something that needs correcting? Let us knowUpdated October 11, 2024