CVE-2018-13024

Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action...

CVE-2019-17676

app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin=index=doSaveSetup URI...

CVE-2017-11347

Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php...

CVE-2018-9934

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

CVE-2022-44849

A Cross-Site Request Forgery CSRF in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account...

CVE-2022-44849

A Cross-Site Request Forgery CSRF in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account...

CVE-2022-44849

A Cross-Site Request Forgery CSRF in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account...

MetInfo 跨站请求伪造漏洞

Metinfo MetInfo is a content management system CMS developed by China's Mito Metinfo using PHP and Mysql. A security vulnerability exists in MetInfo v7.7, which stems from an Administrator List vulnerability that allows an attacker to arbitrarily add a super administrator account via a cross-site...

PT-2022-27324 · Metinfo · Metinfo

Name of the Vulnerable Software and Affected Versions: MetInfo version 7.7 Description: A Cross-Site Request Forgery CSRF issue in the Administrator List allows attackers to arbitrarily add a Super Administrator account. This enables unauthorized access and control over the system. Recommendation...

CVE-2022-44849

MetInfo v7.7 contains a CSRF in the Administrator List that allows an attacker to arbitrarily add a Super Administrator account. Affected component: Administrator List (MetInfo 7.7). Root cause: CSRF-vulnerability enabling unauthorized privilege elevation. Impact per sources: high confidentiality...

CVE-2022-44849

A Cross-Site Request Forgery CSRF in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account...

The vulnerability of the index.php implementation in the Metinfo CMS system allows a perpetrator to execute arbitrary SQL code.

The vulnerability of the index.php script implementation in the Metinfo CMS system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

The vulnerability of the member/getpassword.php?lang=cn&a=dovalid implementation in the CMS system Metinfo allows a perpetrator to execute arbitrary SQL code.

The vulnerability of the member/getpassword.php?lang=cn&a=dovalid script in the CMS system Metinfo is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

Metinfo SQL Injection Vulnerability (CNVD-2022-14806)

MetInfo is a content management system CMS developed using PHP and Mysql. A SQL injection vulnerability exists in Metinfo, which stems from the product's failure to secure the special characters in the tablepara parameter in the parameteradmin.class.php file. An attacker could exploit this...

Metinfo SQL Injection Vulnerability (CNVD-2022-14805)

MetInfo is a content management system CMS developed using PHP and Mysql. A SQL injection vulnerability exists in Metinfo, which stems from the product's failure to secure the special characters in the doModify parameter in the languagegeneral.class.php file. An attacker could exploit this...

CVE-2022-22295

Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameteradmin.class.php via the tablepara parameter...

CVE-2022-22295

Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameteradmin.class.php via the tablepara parameter...

CVE-2022-23335

Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in languagegeneral.class.php via doModifyParameter...

CVE-2022-23335

Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in languagegeneral.class.php via doModifyParameter...