CVE-2017-14146
HighSummary
HelpDEZk version 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory.
Risk Assessment
This vulnerability may lead to remote code execution, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update HelpDEZk to the latest version and implement strict controls over uploaded files to prevent the upload of dangerous file types.
Other vulnerabilities in HelpDEZk 1.1.1
See all- CVE-2017-7447High
HelpDEZk version 1.1.1 has a CSRF vulnerability in admin/home#/logos/, which can lead to remote execution of arbitrary PHP code.
- CVE-2017-7446High
HelpDEZk version 1.1.1 has a CSRF vulnerability in the path admin/home#/person/, allowing for the acquisition of admin privileges.
- CVE-2017-14145Critical
HelpDEZk version 1.1.1 has an SQL Injection vulnerability in the loginController.php file, occurring in the selectWarning function. This issue is related to the admin/login/getWarningInfo/id/ PATH_INFO.
Original NVD description (English source)
HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory.