CVE-2017-12756

High

Published: 09/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In extplorer versions 2.1.9 and prior, there is a command injection vulnerability in the transfer function from another server, allowing an attacker to inject commands via the userfile[0] parameter.

Risk Assessment

An attacker can exploit this vulnerability to execute unauthorized commands on the server, potentially leading to serious security breaches.

Recommendation

It is recommended to upgrade to the latest version of extplorer to mitigate this vulnerability and to monitor logs for potential attack attempts.

Other vulnerabilities in extplorer

CVE-2016-4313High
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archive file.

Original NVD description (English source)

Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile[0] parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS