NukeViet 4.5.06 Admin Internal File Read via Remote Upload

Key Information Details Software Type: Web App Software Name: NukeViet Affected Version: 4.5.06 Software Vendor: VINADES.,JSC Software Link: https://github.com/nukeviet/nukeviet Severity: Medium CVSS Score: 6.4 CVE Link: N/A Affected Assets: 3588+ Discovery Date: Jan 18th, 2025 PoC Exploit: N/A Description A file read vulnerability exists in , allowing site administrators to load files via URL. There are no security measures in place to prevent attackers from loading data from internal web services into NukeViet. Malicious actors with limited site admin privileges can exploit this vulnerability by uploading internal files (such as archives or documents) to NukeViet, then downloading them to their own machines and accessing their contents. A limitation is that only media files (images, videos, audio), archives (tar, zip), or documents (pdf, docx, doc) can be loaded unless text/html loading is enabled (disabled by default). The "upload" feature allows uploading these file types via their URLs. Reproduction Steps Requires an account with at least "module administrator" privileges. Access the endpoint and select "Banner" from the directory list. Log in to the account via the admin panel: Navigate to and select "Banner" from the directory list. Click the blue "Select Upload Mode" button > choose "Remote Upload". Enter an internal URL, e.g., Add a comment for the image and click the "Upload File" button. This will download the file from the internal resource and make it available for download. Proof-of-Concept (PoC) Video Video published on: May 24, 2025 02:28 AM

Goal Reached Thanks to every supporter — we hit 100%!

NukeViet 4.5.06 Admin Internal File Read via Remote Upload