CVE-2017-11715
CriticalSummary
In MetInfo versions up to 5.3.17, the job/uploadfile_save.php file blocks the .php extension but not related extensions, which may allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions.
Risk Assessment
The organization may be exposed to remote code execution, potentially allowing unauthorized users to gain control over the system.
Recommendation
It is recommended to update MetInfo to the latest version and implement additional security measures to prevent unauthorized file uploads.
Other vulnerabilities in MetInfo
See all- CVE-2017-11717High
MetInfo through versions 5.3.17 accepts the same CAPTCHA response for 120 seconds, making it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream.
- CVE-2017-11500High
In MetInfo 5.3.17, there is a directory traversal vulnerability. A remote attacker can use '..\' in the filenames parameter of /admin/system/database/filedown.php to delete any .zip file on the server.
- CVE-2017-11347High
CVE-2017-11347 vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script containing a malicious image. This is related to admin/include/common.inc.php and admin/app/physical/physical.php.
- CVE-2020-20585High
A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.
- CVE-2020-21517Medium
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.
Original NVD description (English source)
job/uploadfile_save.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php.