Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function’s improper judgment of the request parameters, triggers remote code execution.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-20287
Reference (s):
- http://www.yccms.net/
- https://blog.jiguang.xyz/posts/remote-code-execution-via-upload-image/