CVE-2018-7271

An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/configdb.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell...

Command Execution Vulnerability in MetInfo Version 6.0.0 Configuration File

MetInfo is a Content Management System CMS developed using PHP and Mysql. A command execution vulnerability exists in the MetInfo version 6.0.0 configuration file. The vulnerability is caused due to improper filtering of the database configuration file during program reinstallation, which allows...

Remote Code Execution Vulnerability in MetInfo Version 5.3.19

MetInfo is a Content Management System CMS developed using PHP and Mysql. A remote code execution vulnerability exists in MetInfo version 5.3.19, which can be exploited by an authenticated remote attacker to obtain a webshell and gain control of the server...

Variable Override Vulnerability in MetInfo Version 5.3.19 at Password Retrieval

MetInfo is a Content Management System CMS developed using PHP and Mysql. A variable override vulnerability exists in MetInfo version 5.3.19 at the password retrieval. An attacker can exploit the vulnerability to obtain a password reset link, bypass authentication to change the administrator...

Mito MetInfo Path Traversal Vulnerability

Mito MetInfo is a content management system CMS developed using PHP and Mysql. A directory traversal vulnerability exists in Mito MetInfo version 5.3.17. A remote attacker can exploit this vulnerability by sending the 'filenames' parameter to the file /admin/system/database/filedown.php to delete...

Command Execution Vulnerability in MetInfo Version 5.3.19

MetInfo is a Content Management System CMS developed using PHP and Mysql. A command execution vulnerability exists in MetInfo version 5.3.19 patch bypass. After logging in to the system, an attacker can upload a file through the address bar icon, corresponding to change the name of the image file...

Reflected Cross-Site Scripting Vulnerability in MetInfo's login_check.php Page

MetInfo is a Content Management System CMS developed using PHP and Mysql. A reflective cross-site scripting vulnerability exists in the logincheck.php page in MetInfo version 5.3.18. An attacker can construct XSS statements and perform pop-up box operations to obtain user cookies and other...

MetInfo Directory Traversal Vulnerability

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A directory traversal vulnerability exists in MetInfo version 5.3.17. A remote attacker can exploit this vulnerability to read information in an ini format file...

CVE-2017-14513

Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the ffilename parameter in a fingerprintdo action to admin/app/physical/physical.php...

Directory traversal

Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the ffilename parameter in a fingerprintdo action to admin/app/physical/physical.php...

CVE-2017-14513

Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the ffilename parameter in a fingerprintdo action to admin/app/physical/physical.php...

CVE-2017-14513

MetInfo 5.3.17 contains a directory traversal vulnerability that lets remote attackers read arbitrary INI-format files via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php. Exploitation could disclose sensitive data from the server. Affected software/component...

CVE-2017-14513

Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the ffilename parameter in a fingerprintdo action to admin/app/physical/physical.php...

Arbitrary File Deletion Vulnerability in MetInfo Version 5.3.18 Backend

MetInfo is a Content Management System CMS developed using PHP and Mysql. An arbitrary file deletion vulnerability exists in a function in MetInfo version 5.3.18 physical.php. An attacker can exploit this vulnerability to delete task files...

Command Execution Vulnerability Due to Improper Filtering of Database Configuration File in MetInfo Version 5.3.18

MetInfo is a Content Management System CMS developed using PHP and Mysql. A security vulnerability exists in the backend of MetInfo version 5.3.18. The vulnerability is due to improper filtering of the database configuration file during program reinstallation, resulting in malicious code that can...

Arbitrary file write vulnerability in MetInfo version 5.3.18 physical.php

MetInfo is a Content Management System CMS developed using PHP and Mysql. An arbitrary file write vulnerability exists in MetInfo version 5.3.18 in physical.php. An attacker can exploit the CSRF vulnerability to remotely write arbitrary content and gain server privileges...

Metinfo 5.3.17 front Desk SQL injection vulnerability

Metinfo 8 January 1, upgraded version, fixes an influence of less than or equal to 5. 3. 17 version almost can be traced back to all 5. x version of the SQL injection vulnerability. This SQL injection vulnerability is not affected by soft-WAF impact, can directly access the data, the impact is...

MetInfo cross-site scripting vulnerability (CNVD-2017-27794)

MetInfo is a Content Management System CMS developed using PHP and Mysql. A cross-site scripting vulnerability exists in MetInfo 5.3.17 and earlier versions. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML via HTML Edit Mode...

CVE-2017-11716

MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode...

CVE-2017-11715

job/uploadfilesave.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php...