CVE-2017-9741

Critical

Published: 18/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The install/make-config.php file in ProjectSend r754 has a vulnerability that allows remote attackers to execute arbitrary PHP code via manipulation of the dbprefix parameter. This issue is related to replacing TABLES_PREFIX in the configuration file.

Risk Assessment

An attacker could exploit this vulnerability to remotely execute code, potentially leading to system takeover or data leakage. Organizations should be aware of the risks associated with unauthorized access.

Recommendation

It is recommended to update ProjectSend to the latest version to mitigate this vulnerability. Additionally, a security audit of the application's configuration should be conducted.

Original NVD description (English source)

install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file.