critical9.8Public exploit code
CVE-2019-9194
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)2019-03-13 · remote · php · Verified
- elFinder 2.1.47 - 'PHP connector' Command Injection2019-03-04 · webapps · php · Verified
Impact
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Std42 | Elfinder | before 2.1.48 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Studio-42/elFinder/blob/master/README.md
- https://github.com/Studio-42/elFinder/compare/6884c4f...0740028
- https://github.com/Studio-42/elFinder/releases/tag/2.1.48
- https://www.exploit-db.com/exploits/46481/
- https://www.exploit-db.com/exploits/46539/
- https://github.com/Studio-42/elFinder/blob/master/README.md
- https://github.com/Studio-42/elFinder/compare/6884c4f...0740028
- https://github.com/Studio-42/elFinder/releases/tag/2.1.48
- https://www.exploit-db.com/exploits/46481/
- https://www.exploit-db.com/exploits/46539/