The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by <?php system($_GET[cmd]); ?> in a login request.
References
| Link | Resource |
|---|---|
| https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec | Patch Third Party Advisory |
| https://s1.gps-server.net/changelog.txt | Release Notes Vendor Advisory |
| https://www.exploit-db.com/exploits/43431/ | Exploit Third Party Advisory VDB Entry |
| https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec | Patch Third Party Advisory |
| https://s1.gps-server.net/changelog.txt | Release Notes Vendor Advisory |
| https://www.exploit-db.com/exploits/43431/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec - Patch, Third Party Advisory | |
| References | () https://s1.gps-server.net/changelog.txt - Release Notes, Vendor Advisory | |
| References | () https://www.exploit-db.com/exploits/43431/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2018-01-02 15:29
Updated : 2024-11-21 03:17
NVD link : CVE-2017-17098
Mitre link : CVE-2017-17098
CVE.ORG link : CVE-2017-17098
JSON object : View
Products Affected
gps-server
- gps_tracking_software
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')