PT-2017-11667 · Contao · Contao

Leo Feyer · Published 2017-07-21 · Updated 2022-05-13 · CVE-2017-10993

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao versions prior to 3.5.28 Contao versions 4.x prior to 4.4.1

Description The issue allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL. This can be exploited by a logged-in back-end user who manipulates a URL parameter to include arbitrary PHP files. The attack is limited to existing PHP files on the server, as Contao does not allow uploading PHP files through its file manager.

Recommendations For Contao versions prior to 3.5.28, update to version 3.5.28 or later. For Contao versions 4.x prior to 4.4.1, update to version 4.4.1 or later. As a temporary workaround, consider restricting access to sensitive PHP files and limiting the ability of back-end users to manipulate URL parameters until a patch is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-10993

GHSA-X5G4-CRXQ-QXJX

Affected Products

Contao

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2017-10993.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2017-10993.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2017-10993.yaml · Exploit
• https://contao.org/en/news/contao-3_5_28.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10993 · Security Note
• https://osv.dev/vulnerability/CVE-2017-10993 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x5g4-crxq-qxjx · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10993 · Note
• https://contao.org/en/news/contao-4_4_1.html · Note