Описание
An issue was discovered in Gazie 7.32. A successful installation does not remove or block (or in any other way prevent use of) its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hidden_req POST parameter.
Ссылки
- PatchThird Party Advisory
- PatchThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 7.9 (включая) до 7.32 (включая)
cpe:2.3:a:gazie_project:gazie:*:*:*:*:*:*:*:*
EPSS
Процентиль: 60%
0.00404
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-552
Связанные уязвимости
github
больше 3 лет назад
An issue was discovered in Gazie 7.32. A successful installation does not remove or block (or in any other way prevent use of) its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hidden_req POST parameter.
EPSS
Процентиль: 60%
0.00404
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-552