Discovered by Jake Cleland on behalf of The Missing Link Security
MicroRealEstate used parameters passed in a URL to determine file paths when writing uploaded files to disk. As a result, adversaries could control parts of the file path to write files to unauthorised directories, potentially overwriting system files and corrupting the platform.
Fixed Versions:
N/A
The Missing Link acknowledges the Traditional Owners of the land where we work and live. We pay our respects to Elders past, present and emerging. We celebrate the stories, culture and traditions of Aboriginal and Torres Strait Islanders of all communities who also work and live on this land.