CVE-2019-17490

app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge (aka jnoj) 0.8.0 allows arbitrary file upload, as demonstrated by PHP code (with a .php filename but the image/png content type) to the web/polygon/problem/tests URI.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2019-10-10

Last modified

2024-08-05

Weaknesses

CWE-434

Affected products

• Jiangnan Online Judge (Jnoj)

References

• https://github.com/shi-yang/jnoj/issues/51