critical9.8Public exploit code
CVE-2017-17098
The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code v…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- gps-server.net GPS Tracking Software < 3.1 - Multiple Vulnerabilities2018-01-05 · webapps · php
Impact
The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by <?php system($_GET[cmd]); ?> in a login request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gps-Server | Gps Tracking Software | through 3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec
- https://s1.gps-server.net/changelog.txt
- https://www.exploit-db.com/exploits/43431/
- https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec
- https://s1.gps-server.net/changelog.txt
- https://www.exploit-db.com/exploits/43431/