CVE-2017-9602

Critical

Published: 16/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The KBVault Mysql Free Knowledge Base application package version 0.16a includes a file management component that allows unauthenticated users to access file upload and deletion functionalities. A user can upload an ASPX script to the Uploads/Documents/ directory, enabling the execution of arbitrary code.

Risk Assessment

The risk to the organization involves the potential execution of malicious code by unauthorized users, which could lead to system compromise and data loss.

Recommendation

It is recommended to update the application to the latest version and implement appropriate authentication and authorization mechanisms for file management functionalities.

Original NVD description (English source)

KBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer.aspx?id=/Uploads file-management component. An unauthenticated user can access the file upload and deletion functionality. Through this functionality, a user can upload an ASPX script to Uploads/Documents/ to run any arbitrary code.