CVE-2017-11347
HighSummary
CVE-2017-11347 vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script containing a malicious image. This is related to admin/include/common.inc.php and admin/app/physical/physical.php.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code on the server, potentially leading to system takeover or data leakage.
Recommendation
It is recommended to update MetInfo to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in MetInfo 5.3.17
See all- CVE-2017-11717High
MetInfo through versions 5.3.17 accepts the same CAPTCHA response for 120 seconds, making it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream.
- CVE-2017-11500High
In MetInfo 5.3.17, there is a directory traversal vulnerability. A remote attacker can use '..\' in the filenames parameter of /admin/system/database/filedown.php to delete any .zip file on the server.
- CVE-2017-11715Critical
In MetInfo versions up to 5.3.17, the job/uploadfile_save.php file blocks the .php extension but not related extensions, which may allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions.
- CVE-2020-20585High
A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.
- CVE-2020-21517Medium
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.
Original NVD description (English source)
Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php.