There is a file upload vulnerability in lines 36 to 63 of src/main/java/com/cool/core/file/strategy/LocalFileUploadStrategy.java

[liyunqiangs]

The backed did not filter the types of uploaded files

When adding a user,click on "Upload Profile Picture" and upload the Trojan file that has already had the extension changed to ".jpg".

Use Burp to intercept the request packets and change the file extension from jpg to jsp.

JSP Trojan file upload successful.