Affected Component
Description
Insecure file upload functionality leads to remote code execution.
Steps to reproduce
Login as Admin
Navigate to below mentioned endpoint
"/admin/?page=system_info"
There will be a file upload function for uploading System Logo and Website Cover , where any file can be uploded .
It is possible to upload any malicious files which includes php file for remote code execution,svg for Cross site scripting and so on.
Impact
Insecure file upload leads to Remote code execution and stored cross site scripting.