CVE-2017-14513

Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the ffilename parameter in a fingerprintdo action to admin/app/physical/physical.php...

Arbitrary file write vulnerability in MetInfo version 5.3.18 physical.php

MetInfo is a Content Management System CMS developed using PHP and Mysql. An arbitrary file write vulnerability exists in MetInfo version 5.3.18 in physical.php. An attacker can exploit the CSRF vulnerability to remotely write arbitrary content and gain server privileges...

MetInfo System URL Redirection Vulnerability

MetInfo is a Content Management System CMS developed using PHP and Mysql. A redirection vulnerability exists in MetInfo 5.3.17 and earlier versions. An attacker constructs a malicious URI and induces the user to parse it, which can redirect the user to any WEB site for phishing attacks...