CVE-2017-11717
HighSummary
MetInfo through versions 5.3.17 accepts the same CAPTCHA response for 120 seconds, making it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream.
Risk Assessment
Attackers could exploit this vulnerability to gain unauthorized access to user accounts, leading to unauthorized access to the system.
Recommendation
It is recommended to update MetInfo to the latest version to mitigate this vulnerability and implement additional CAPTCHA security mechanisms.
Other vulnerabilities in MetInfo
See all- CVE-2017-11500High
In MetInfo 5.3.17, there is a directory traversal vulnerability. A remote attacker can use '..\' in the filenames parameter of /admin/system/database/filedown.php to delete any .zip file on the server.
- CVE-2017-11347High
CVE-2017-11347 vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script containing a malicious image. This is related to admin/include/common.inc.php and admin/app/physical/physical.php.
- CVE-2017-11715Critical
In MetInfo versions up to 5.3.17, the job/uploadfile_save.php file blocks the .php extension but not related extensions, which may allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions.
- CVE-2020-20585High
A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.
- CVE-2020-21517Medium
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.
Original NVD description (English source)
MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page.