CVE-2017-11347 Code injection in n/a
Authenticated attackers can execute arbitrary code by uploading malicious images that are processed into PHP scripts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-11347?
CVE-2017-11347 is a high-severity code injection vulnerability in Metinfo Metinfo, published on 16 Jul 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php.
Which versions are affected by CVE-2017-11347?
It affects 1 product.
Products include Metinfo Metinfo.
How do I fix CVE-2017-11347?
No fix has been published for CVE-2017-11347 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-11347 being exploited?
There is no known exploitation of CVE-2017-11347 in the wild and no public exploit code.
Other vulnerabilities in Metinfo Metinfo
Sources
Also known as GHSA-c99f-5qg7-853q.