PT-2017-12195 · Metinfo · Metinfo

Publicado 2017-07-28 · Atualizado 2017-08-09 · CVE-2017-11715

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MetInfo versions prior to 5.3.18

Description The issue allows remote authenticated admins to potentially execute arbitrary PHP code by uploading a file with a specific extension. This is possible because the software blocks the .php extension but not related extensions, such as .phtml. The exploitation involves certain actions with specific files, including admin/system/safe.php and job/cv.php.

Recommendations For MetInfo versions prior to 5.3.18, update to version 5.3.18 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only necessary extensions and limiting access to the upload functionality to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-11715

Produtos afetados

Metinfo

Referências · 3

• 🔥 https://lncken.cn/?p=316 · Exploit
• https://osv.dev/vulnerability/CVE-2017-11715 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11715 · Nota de Segurança