Race condition

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=?php and admin/databack/bakuptables.php?2=fileputcontents URIs because...

CVE-2019-7718

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=?php and admin/databack/bakuptables.php?2=fileputcontents URIs because...

CVE-2019-7718

MetInfo 6.x contains a race condition in the backend database backup function. The issue allows an attacker to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=

Metinfo Competitive Conditions Vulnerability

MetInfo is a content management system CMS developed by China Mito MetInfo using PHP and Mysql. A competitive condition vulnerability exists in MetInfo. An attacker can exploit this vulnerability by means of a competitive condition in the backend database backup function via admin / index.php?n =...

File write vulnerability in MetInfo version 6.1.3 backend

MetInfo is a content management system CMS developed using PHP and Mysql by Changsha Mito Information Technology Co. A file write vulnerability exists in the backend of MetInfo version 6.1.3, which can be exploited by attackers to gain control of the web server...

Arbitrary File Deletion Vulnerability in MetInfo Backend

MetInfo is a content management system CMS developed using PHP and Mysql by Changsha Mito Information Technology Co. There is an arbitrary file deletion vulnerability in the MetInfo backend, which can be exploited by an attacker to delete arbitrary files...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2019-03299)

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site scripting vulnerability exists in MetInfo versions 6.x to 6.1.3, which can be exploited by remote attackers to execute JavaScript code by sending the 'urlarray' paramete...

CVE-2018-20486

MetInfo 6.x through 6.1.3 has XSS via the /admin/login/logincheck.php urlarray parameter...

Design/Logic Flaw

MetInfo 6.x through 6.1.3 has XSS via the /admin/login/logincheck.php urlarray parameter...

CVE-2018-20486

MetInfo 6.x through 6.1.3 has XSS via the /admin/login/logincheck.php urlarray parameter...

CVE-2018-20486

MetInfo 6.x through 6.1.3 has XSS via the /admin/login/logincheck.php urlarray parameter...

CVE-2018-20486

MetInfo 6.x through 6.1.3 contains a cross-site scripting (XSS) vulnerability that can be triggered via the url_array[] parameter in /admin/login/login_check.php. This issue is reported across multiple sources (NVD entry CVE-2018-20486 and related records) and is described as an XSS vulnerability...

Metinfo cross-site scripting vulnerability (CNVD-2018-24618)

MetInfo is a content management system CMS developed using PHP and Mysql by Changsha Mito Information Technology Co. A cross-site scripting vulnerability exists in MetInfo version 6.1.3, which can be exploited by remote attackers to inject arbitrary Web script or HTML...

Metinfo Cross-Site Scripting Vulnerability (CNVD-2019-05925)

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site scripting vulnerability exists in the admin/column/move.php interface in Metinfo version 6.1.3. A remote attacker can exploit this vulnerability to inject arbitrary web...

CVE-2018-19836

In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers including the Cookie header, and common.inc.php allows registering variables from the $COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such ...

CVE-2018-19836

In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers including the Cookie header, and common.inc.php allows registering variables from the $COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such ...

Cross site scripting

Metinfo 6.1.3 has reflected XSS via the admin/column/move.php langcolumnerr4 parameter...

CVE-2018-19835

Metinfo 6.1.3 has reflected XSS via the admin/column/move.php langcolumnerr4 parameter...

CVE-2018-19835

Metinfo 6.1.3 has reflected XSS via the admin/column/move.php langcolumnerr4 parameter...

Design/Logic Flaw

In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers including the Cookie header, and common.inc.php allows registering variables from the $COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such ...