Sheratan4

**Name of the Vulnerable Software and Affected Versions** osuuu LightPicture version 1.2.2 **Description** A critical vulnerability has been found in osuuu LightPicture, affecting the function upload of the file /app/controller/Api.php. The manipulation of the `file` argument leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For osuuu LightPicture version 1.2.2, consider disabling the upload function in /app/controller/Api.php until a patch is available to prevent unrestricted file upload. Restrict access to the /app/controller/Api.php file to minimize the risk of exploitation. Avoid using the `file` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zorlan SkyCaiji version 2.9 **Description** A critical vulnerability has been found in Zorlan SkyCaiji, affecting the `fileAction` function of the `vendor/skycaiji/app/admin/controller/Tool.php` file. The manipulation of the `save data` argument leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** As a temporary workaround, consider disabling the `fileAction` function until a patch is available. Restrict access to the `vendor/skycaiji/app/admin/controller/Tool.php` file to minimize the risk of exploitation. Avoid using the `save data` argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zorlan SkyCaiji version 2.9 **Description** A critical vulnerability was found in Zorlan SkyCaiji, affecting the `previewAction` function of the file `vendor/skycaiji/app/admin/controller/Tool.php`. The manipulation of the `data` argument leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Zorlan SkyCaiji version 2.9, as a temporary workaround, consider disabling the `previewAction` function until a patch is available. Restrict access to the `vendor/skycaiji/app/admin/controller/Tool.php` file to minimize the risk of exploitation. Avoid using the `data` argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.