This project allows users to upload pictures when adding the book function. However,this function does not perform any checks on the files uploaded by users,which leads to the possibility of users uploading malicious files such as jsp files and image Trojans.
When adding a new book,click on the "Upload" button and upload the JSP Trojan file.
It can be seen that the JSP file has been uploaded to the "upload/image" directory on the server backend.
Search for the keyword "admin" on the homepage and click to enter the detailed page.
Right-click on the icon to open the picture,and it will show that the Trojan has been executed.
This project allows users to upload pictures when adding the book function. However,this function does not perform any checks on the files uploaded by users,which leads to the possibility of users uploading malicious files such as jsp files and image Trojans.
When adding a new book,click on the "Upload" button and upload the JSP Trojan file.
It can be seen that the JSP file has been uploaded to the "upload/image" directory on the server backend.
Search for the keyword "admin" on the homepage and click to enter the detailed page.
Right-click on the icon to open the picture,and it will show that the Trojan has been executed.