CVE-2018-12530

An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF...

CVE-2018-12531

An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into configdb.php, a different vulnerability than CVE-2018-7271...

Directory traversal

An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF...

CVE-2018-12531

An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into configdb.php, a different vulnerability than CVE-2018-7271...

Code injection

An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into configdb.php, a different vulnerability than CVE-2018-7271...

CVE-2018-12531

MetInfo 6.0.0 contains a remote code execution vulnerability: during installation, install/index.php allows attackers to write arbitrary PHP into config_db.php, enabling web shell/command execution. Affected component is the install/config path in MetInfo 6.0.0; root cause is insufficient filteri...

CVE-2018-12530

An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF...

CVE-2018-12531

An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into configdb.php, a different vulnerability than CVE-2018-7271...

CVE-2018-12530

The CVE-2018-12530 entry concerns MetInfo 6.0.0, where the file admin/app/batch/csvup.php permits a directory traversal via flienamecsv=../ to delete arbitrary files. Exploitation is described as CSRF-enabled, enabling remote attackers to perform file deletions. This vulnerability is mapped in NV...

MetInfo 6.0.0 Has Arbitrary File Read Vulnerability

MetInfo is a content management system developed using PHP and Mysql. MetInfo 6.0.0 suffers from an arbitrary file read vulnerability, which can be exploited by an attacker to obtain sensitive information on a website...

SQL Injection Vulnerability in MetInfo v6.0

MetInfo is a Content Management System CMS developed using PHP and Mysql. A SQL injection vulnerability exists in MetInfo v6.0. An attacker can exploit the vulnerability to read data from a website database...

Arbitrary File Read Vulnerability in MetInfo v6.0

MetInfo is a Content Management System CMS developed using PHP and Mysql. An arbitrary file read vulnerability exists in MetInfo v6.0. An attacker can exploit the vulnerability to read sensitive files on a website...

MetInfo cross-site scripting vulnerability (CNVD-2018-08418)

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site scripting vulnerability exists in the front page of MetInfo version 6.0. A remote attacker can exploit this vulnerability by sending a feedback message to an administrat...

Cross site scripting

The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator...

CVE-2018-9985

The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator...

CVE-2018-9985

The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator...

CVE-2018-9985

The CVE-2018-9985 issue affects MetInfo 6.0 where the front page permits cross-site scripting (XSS) by submitting a feedback message to an administrator. Documented sources (NVD/CNVD) confirm an XSS vulnerability in MetInfo 6.0’s front page, but no specific exploit details, affected file paths, o...

CVE-2018-9985

The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator...

Design/Logic Flaw

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

CVE-2018-9934

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...