| Package | Affected versions | Patched versions |
|---|---|---|
| i-onenet | ≥ 3.0.7, ≤ 3.0.53≥ 4.0.4, ≤ 4.0.16 |
In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, the specific upload web module doesn't verify the file extension and type, and an attacker can upload a webshell. After the webshell upload, an attacker can use the webshell to perform remote code exection such as running a system command.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free