Skip to content

CVE-2017-9249 Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated users to inject arbitrary web script or HTML persistently by uploading a crafted HTML file. The attack vector is....

MediumCVSS 5.4 EPSS 0.68%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated users to inject arbitrary web script or HTML persistently by uploading a crafted HTML file. The attack vector is the content of this file, and the filename must be specified in the PATH_INFO to readfile.php.

Affected products

ProductAffected versionsFixed in
allen disk project allen disk = 1.6 No fix listed

References

  • 98743 third-party-advisory vdb-entry
  • github.com exploit third-party-advisory