CVE-2019-17676

app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI...

CVE-2019-17676

CVE-2019-17676 relates to MetInfo 7.0.0beta where a CSRF flaw in app/system/admin/admin/index.class.php allows an attacker to add a user account via the doSaveSetup action to admin/index.php, demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URL. The vulnerability stems from CSRF exposure i...

PT-2019-15249

Name of the Vulnerable Software and Affected Versions MetInfo version 7.0.0beta Description The issue allows for a CSRF attack, enabling an attacker to add a user account. This is achieved by sending a doSaveSetup action to the admin/index.php endpoint, for example, via an...

CVE-2019-17676: Cross-Site Request Forgery (CSRF)

app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI...

CVE-2019-17613

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

CVE-2019-17613

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

CVE-2019-17613: Improper Control of Generation of Code

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

PT-2019-15182

Name of the Vulnerable Software and Affected Versions Hotaru CMS version 1.7.2 Description A stored XSS issue was found in the admin index.php?page=settings SITE NAME field, allowing for potential exploitation. Recommendations For Hotaru CMS version 1.7.2, update to a newer version that contains ...

CVE-2019-16867

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...

CVE-2019-16867

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...

CVE-2019-16867

HongCMS 3.0.0 is affected by a path-traversal vulnerability allowing arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete (and similar CVE-2018-16774 path). Root cause is insufficient validation of the file path, enabling deletion of critical file...

CVE-2019-16867: Improper Limitation of a Pathname to a Restricted Directory

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...

PT-2019-14838

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion by utilizing a ../ in the file parameter to the "admin/index.php/database/ajax" endpoint with the action set to delete. This can be exploited to delete critical fil...

CVE-2019-10687

KBPublisher 6.0.2.1 contains SQL injection vulnerabilities in multiple entry points: admin/index.php?module=report&entry_id[0] and admin/index.php?module=log&id, as well as index.php?View=print&id[] (and related POST parameters). Some sources note the issue affects both admin and public (unauthen...

CVE-2019-10687: Improper Neutralization of Special Elements used in an SQL Command

KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entryid0 parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id= request...

PT-2019-11993

Name of the Vulnerable Software and Affected Versions KBPublisher version 6.0.2.1 Description The issue concerns SQL Injection, which can be exploited through specific parameters in the application. The vulnerable parameters include entry id0 in the "admin/index.php?module=report" endpoint, id in...

PT-2019-13498

Name of the Vulnerable Software and Affected Versions Metinfo versions 6.x Description The issue allows SQL Injection via the id parameter in an "admin/index.php?n=ui set&m=admin&c=index&a=doget text content&table=lang&field=1" request. Recommendations For Metinfo version 6.x, consider restrictin...

CVE-2019-13969: Improper Neutralization of Special Elements used in an SQL Command

Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset&m=admin&c=index&a=dogettextcontent&table=lang&field=1 request...

Cross site request forgery (csrf)

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...

CVE-2017-12790

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...