4 matches found
CVE-2017-11715
job/uploadfilesave.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php...
CVE-2017-11715
job/uploadfilesave.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php...
CVE-2017-11715
job/uploadfilesave.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php...
CVE-2017-11715
MetInfo ≤ 5.3.17 is vulnerable due to blocking only the .php extension in job/uploadfile_save.php, while not blocking related extensions. An authenticated admin could upload a .phtml file after certain actions (involving admin/system/safe.php and job/cv.php) to execute arbitrary PHP code remotely...