CVE-2017-11366

CRITICAL9.8EPSS 34.3%

Codiad Vulnerable to Shell Command Injection

發布日:2022/5/13修改日:2024/4/25

描述

components/filemanager/class.filemanager.php in Codiad before 2.8.3 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by `search_file_type`.

受影響套件(1)

Packagist/codiad/codiadfrom 0, < 2.8.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-11366
PATCHhttps://github.com/Codiad/Codiad
WEBhttps://github.com/Codiad/Codiad/commit/ca5089eeba42d16ce3a7f86be628ac7750780111
WEBhttps://github.com/Codiad/Codiad/issues/1011
WEBhttps://github.com/Codiad/Codiad/pull/1013
WEBhttps://github.com/Codiad/Codiad/pull/1013/commits/b3645b4c6718cef6de7003f41aafe7bfcc0395d1
WEBhttp://www.jianshu.com/p/41ac7ac2a7af