Vulnerability in danielbrendel hortusfox-web

[ Description ]Official description

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/danielbrendel/hortusfox-web
• github.com/danielbrendel/hortusfox-web/blob/v6.3/app/models/PlantAttachmentModel.php
• github.com/danielbrendel/hortusfox-web/blob/v6.3/app/resources/js/app.js
• github.com/danielbrendel/hortusfox-web/security/advisories/GHSA-8phf-v3xj-8jjg
• hackmd.io/@leediay/stored-xss-hortusfox-via-plant-attachment
• www.vulncheck.com/advisories/hortusfox-through-6.3-unrestricted-file-upload-via-plant-a…