CVE-2017-11366

CRITICAL9.8EPSS 34.3%

Codiad Vulnerable to Shell Command Injection

Published: 5/13/2022Modified: 4/25/2024

Description

components/filemanager/class.filemanager.php in Codiad before 2.8.3 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by `search_file_type`.

Affected packages (1)

Packagist/codiad/codiadfrom 0, < 2.8.3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-11366
PATCHhttps://github.com/Codiad/Codiad
WEBhttps://github.com/Codiad/Codiad/commit/ca5089eeba42d16ce3a7f86be628ac7750780111
WEBhttps://github.com/Codiad/Codiad/issues/1011
WEBhttps://github.com/Codiad/Codiad/pull/1013
WEBhttps://github.com/Codiad/Codiad/pull/1013/commits/b3645b4c6718cef6de7003f41aafe7bfcc0395d1
WEBhttp://www.jianshu.com/p/41ac7ac2a7af