CVE-2018-11091

CVE-2018-11091 describes a critical arbitrary file upload vulnerability in MyBiz MyProcureNet 5.0.0. An authenticated attacker can manipulate the "HiddenFieldControlCustomWhiteListedExtensions" parameter to bypass file extension whitelisting, allowing the upload of malicious scripts. This flaw carries a CVSS score of 9.9 (CRITICAL) due to its low attack complexity, requiring only low privileges, and enabling complete compromise of confidentiality, integrity, and availability of the affected server. While no public exploit code or active exploitation has been confirmed, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.