CVE-2017-11715
CriticalSummary
In MetInfo versions up to 5.3.17, the job/uploadfile_save.php file blocks the .php extension but not related extensions, which may allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions.
Risk Assessment
The organization may be exposed to remote code execution, potentially allowing unauthorized users to gain control over the system.
Recommendation
It is recommended to update MetInfo to the latest version and implement additional security measures to prevent unauthorized file uploads.
Original NVD description (English source)
job/uploadfile_save.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php.