Directory traversal

Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the ffilename parameter in a fingerprintdo action to admin/app/physical/physical.php...

CVE-2017-14513: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the ffilename parameter in a fingerprintdo action to admin/app/physical/physical.php...

PT-2017-13499

Name of the Vulnerable Software and Affected Versions MetInfo version 5.3.17 Description A directory traversal issue allows remote attackers to read information from any ini format file. This is achieved by exploiting the f filename parameter in a fingerprintdo action to the...

Remote code execution

Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php...

CVE-2017-11347: Undefined Security Weakness

Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php...

MetInfo 5.3.17 Authenticated Code Execution Vulnerability(CVE-2017-11347)

MetInfo 5.3.17 Authenticated Code Execution Vulnerability Technical Description: We can use the GPC data to register variables in admin/include/common.inc.php: php foreacharray'COOKIE', 'POST', 'GET' as $request foreach$$request as $key = $value $key0 != '' && $$key = daddslashes$value,0,0,1;...

PT-2017-11948

Name of the Vulnerable Software and Affected Versions MetInfo version 5.3.17 Description The issue allows a remote authenticated attacker to execute code by generating a PHP script with the content of a malicious image. This is related to the files admin/include/common.inc.php and...