Code injection

An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into configdb.php, a different vulnerability than CVE-2018-7271...

CVE-2018-7271

CVE-2018-7271 affects MetInfo 6.0.0. In the installer (install/install.php), the config/config_db.php filtering during installation is insufficient, allowing an attacker to inject malicious code and potentially execute arbitrary commands or obtain a web shell. The root cause is sloppy filtering o...