PT-2017-13279 · Helpdezk · Helpdezk

Publicado 2017-09-05 · Atualizado 2017-09-06 · CVE-2017-14146

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HelpDEZk version 1.1.1

Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved by uploading a .php attachment and then requesting it in the "helpdezkappuploadshelpdezkattachments" directory.

Recommendations For HelpDEZk version 1.1.1, consider restricting access to the "helpdezkappuploadshelpdezkattachments" directory to prevent exploitation. Additionally, disabling the ability to upload .php attachments can serve as a temporary workaround until a patch is available.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-14146

Produtos afetados

Helpdezk

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-14146 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-14146 · Aviso do Fabricante
• ❌ https://github.com/M4ple/vulnerability/blob/master/helpdezk_file_upload/helpdezk_file_upload.md · Nota, Deleted