PT-2018-17989 · Metinfo · Metinfo

Published 2018-02-21 · Updated 2018-03-21 · CVE-2018-7271

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MetInfo version 6.0.0

Description An issue was discovered in the installation process of MetInfo, where the filtering of the config/config db.php configuration file is not rigorous. This allows an attacker to insert malicious code during the installation process, potentially leading to the execution of arbitrary commands or the obtainment of a web shell.

Recommendations For MetInfo version 6.0.0, as a temporary workaround, consider restricting access to the installation process and the config/config db.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2018-7271

Affected Products

Metinfo

References · 3

• 🔥❌ https://github.com/SQYY/CVE/blob/master/MetInfo_G.txt · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2018-7271 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7271 · Vendor Advisory