MetInfo vulnerabilities
6 known CVE vulnerabilities in MetInfo, translated and rated.
- CVE-2017-11717High
MetInfo through versions 5.3.17 accepts the same CAPTCHA response for 120 seconds, making it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream.
- CVE-2017-11500High
In MetInfo 5.3.17, there is a directory traversal vulnerability. A remote attacker can use '..\' in the filenames parameter of /admin/system/database/filedown.php to delete any .zip file on the server.
- CVE-2017-11347High
CVE-2017-11347 vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script containing a malicious image. This is related to admin/include/common.inc.php and admin/app/physical/physical.php.
- CVE-2017-11715Critical
In MetInfo versions up to 5.3.17, the job/uploadfile_save.php file blocks the .php extension but not related extensions, which may allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions.
- CVE-2020-20585High
A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.
- CVE-2020-21517Medium
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.