JVN#53886050 Vulnerability in La!cooda WIZ and LacoodaST allowing an arbitrary PHP script execution

La!cooda WIZ from System Consultants Co., Ltd. and LacoodaST from SpaceTag, Inc. are groupware providing schedule and task managements, etc. La!cooda WIZ and LacoodaST contain a vulnerability which may allow a malicious user to execute an arbitrary PHP script on the server.

Impact

If an arbitrary PHP script is executed, files on the server could be deleted or disclosed.

Solution

Update the Software
Apply the latest updates provided by the vendors.
For more information, refer to the vendors’ websites.

Products Affected

• La!cooda WIZ 1.4.0 and earlier
• LacoodaST 2.1.3 and earlier
  For more information, refer to the vendors’ websites.