CVE-2018-7271: Code Injection

Published Feb 21, 2018

Updated

An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/configdb.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell.

Affected Software

1 affected component

Metinfo Metinfo=6.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MetInfo to a version that resolves this vulnerability.
Fixed in 6.0.0

Event History

Feb 21, 2018

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·12:29 AM

DescriptionSeverityWeaknessAffected Software

Jul 19, 58461

Event

03:16 AM

Frequently Asked Questions

What is CVE-2018-7271?

CVE-2018-7271 is a vulnerability discovered in MetInfo 6.0.0 that allows an attacker to execute arbitrary commands or obtain a web shell during the installation process.

How severe is CVE-2018-7271?

CVE-2018-7271 has a severity rating of 8.1 (Critical).

What software versions are affected by CVE-2018-7271?

MetInfo 6.0.0 is the only version affected by CVE-2018-7271.

How can an attacker exploit CVE-2018-7271?

An attacker can exploit CVE-2018-7271 by inserting malicious code during the installation process to execute arbitrary commands or obtain a web shell.

Is there a fix for CVE-2018-7271?

Yes, it is recommended to update to a patched version of MetInfo to fix CVE-2018-7271.