CVE-2017-7447
HighSummary
HelpDEZk version 1.1.1 has a CSRF vulnerability in admin/home#/logos/, which can lead to remote execution of arbitrary PHP code.
Risk Assessment
Exploitation of this vulnerability could allow attackers to remotely execute malicious code, posing a serious security threat to the system.
Recommendation
It is recommended to update HelpDEZk to the latest version to mitigate this vulnerability and implement additional protections against CSRF attacks.
Other vulnerabilities in HelpDEZk 1.1.1
See all- CVE-2017-14146High
HelpDEZk version 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory.
- CVE-2017-7446High
HelpDEZk version 1.1.1 has a CSRF vulnerability in the path admin/home#/person/, allowing for the acquisition of admin privileges.
- CVE-2017-14145Critical
HelpDEZk version 1.1.1 has an SQL Injection vulnerability in the loginController.php file, occurring in the selectWarning function. This issue is related to the admin/login/getWarningInfo/id/ PATH_INFO.
Original NVD description (English source)
HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code.