high8.8Public exploit code
CVE-2021-3317
KLog Server through 2.4.1 allows authenticated command injection.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Klog Server 2.4.1 - Command Injection (Authenticated)2021-02-01 · webapps · php
Impact
KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Klogserver | Klog Server | through 2.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/161208/Klog-Server-2.4.1-Command-Injection.html
- https://docs.unsafe-inline.com/0day/klog-server-authenticated-command-injection
- http://packetstormsecurity.com/files/161208/Klog-Server-2.4.1-Command-Injection.html
- https://docs.unsafe-inline.com/0day/klog-server-authenticated-command-injection