CVE-2017-9602 KBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer.aspx?id=/Uploads file-management component. An unauthenticated user can access the file upload and deleti...
CriticalCVSS 9.8
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
KBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer.aspx?id=/Uploads file-management component. An unauthenticated user can access the file upload and deletion functionality. Through this functionality, a user can upload an ASPX script to Uploads/Documents/ to run any arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kbvault mysql project kbvault mysql | = 0.16a | No fix listed |
References
- 42184 exploit mitigation third-party-advisory vdb-entry