A critical arbitrary file upload vulnerability in by-night sms V1.0 allows authenticated attackers to execute arbitrary code by uploading malicious files.

This vulnerability is an arbitrary file upload flaw located at the /api/sms/upload/headImg endpoint. The application fails to restrict file types or sizes, allowing an authenticated user to upload arbitrary content to the server.

Successful exploitation allows an attacker to upload malicious scripts, such as web shells, to the server, leading to potential remote code execution. This compromises the confidentiality, integrity, and availability of the entire system, justifying the high CVSS score of 8.8. Such access can lead to total system takeover and lateral movement within the network.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /api/sms/upload/headImg endpoint or disable the file upload functionality entirely.

Proactive Monitoring: Monitor server logs for suspicious requests to the upload endpoint and scan the server directories for unexpected file types or newly created executable scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to intercept and block requests to the vulnerable endpoint that contain suspicious file extensions or MIME types.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research write-up.

Given the high CVSS score and the presence of a public proof-of-concept, this vulnerability poses a significant risk to organizational infrastructure. Administrators must prioritize blocking the vulnerable endpoint immediately and continue monitoring vendor channels for an official security patch to address the underlying lack of input validation.