GitHub Advisoryadvisory · Packagist

GHSA-jccv-3h4x-35mv Codiad Vulnerable to Shell Command Injection

CRITICAL Published 2022-05-13 Modified 2024-04-25 Official page ↗
Aliases
CVE-2017-11366
Ecosystem
Packagist
Packages
codiad/codiad
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2024-04-25

Affected packages

• Packagist codiad/codiad: < 2.8.3 → fixed in 2.8.3

Description

components/filemanager/class.filemanager.php in Codiad before 2.8.3 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by `search_file_type`.

Related

Alias · CVE (1)

  • CVE-2017-11366 components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References