PT-2018-17989 · Metinfo · Metinfo

Publicado 2018-02-21 · Atualizado 2018-03-21 · CVE-2018-7271

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MetInfo version 6.0.0

Description An issue was discovered in the installation process of MetInfo, where the filtering of the config/config db.php configuration file is not rigorous. This allows an attacker to insert malicious code during the installation process, potentially leading to the execution of arbitrary commands or the obtainment of a web shell.

Recommendations For MetInfo version 6.0.0, as a temporary workaround, consider restricting access to the installation process and the config/config db.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2018-7271

Produtos afetados

Metinfo

Referências · 3

• 🔥❌ https://github.com/SQYY/CVE/blob/master/MetInfo_G.txt · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2018-7271 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-7271 · Aviso do Fabricante