Quick Playground’s sync REST endpoints compared the sync code loosely and echoed the stored code back, and the image-upload endpoint wrote a request-supplied filename and base64 body to disk without validation. An unauthenticated attacker could bypass the check, upload a PHP file outside the upload directory via path traversal and execute code on the server.
This vulnerability affects the following application versions:
- Quick Playground 1.0.5
- Quick Playground 1.0.6
- Quick Playground 1.0.7
- Quick Playground 1.0.8
- Quick Playground 1.0.9
- Quick Playground 1.1
- Quick Playground 1.2
- Quick Playground 1.2.1
- Quick Playground 1.3
- Quick Playground 1.3.1