File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticat…

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server. The vulnerability exists in the FactoryController.php controller of WebErpMesv2 version 1.17, allowing authenticated attackers to upload malicious files [1]. Источники: - [1] https://github.com/SMEWebify/WebErpMesv2 - [2] https://medium.com/@The_Hiker/wrong-variable-name-leads-to-rce-cve-2025-52130-8ff59a7d245c