critical9.8
CVE-2018-7664
An issue was discovered in ClipBucket before 4.0.0 Release 4902.
Impact
An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the file_name parameter to /api/file_uploader.php or /actions/file_downloader.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Clip-Bucket | Clipbucket | through 4.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.openwall.net/full-disclosure/2018/02/27/1
- https://www.sec-consult.com/en/blog/advisories/os-command-injection-arbitrary-file-upload-sql-injection-in-clipbucket/index.html
- http://lists.openwall.net/full-disclosure/2018/02/27/1
- https://www.sec-consult.com/en/blog/advisories/os-command-injection-arbitrary-file-upload-sql-injection-in-clipbucket/index.html