extplorer - Command Injection Vulnerability (CVE-2017-12756)
Summary
DLA-1063-1: extplorer - security update. Affects extplorer versions < 2.1.0b6+dfsg.3-4+deb7u5. Fixed in 2.1.0b6+dfsg.3-4+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
extplorer is a web-based file manager written in PHP. It provides a user-friendly interface for managing files and directories on a server. The vulnerability (CVE-2017-12756) affects extplorer versions 2.1.9 and prior. It allows an attacker to inject arbitrary commands through the userfile[0] parameter when transferring files from another server.
Vulnerability Detail
The command injection vulnerability in extplorer (CVE-2017-12756) enables an attacker to execute arbitrary commands on the server by manipulating the userfile[0] parameter. This can lead to unauthorized access, data leakage, and potential compromise of the entire system. It is crucial to address this vulnerability promptly to prevent any malicious activities.
How To Fix
Minimum fixed version
2.1.0b6+dfsg.3-4+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade extplorerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The command injection vulnerability (CVE-2017-12756) in extplorer poses a significant risk to the security and integrity of the system. It is crucial to upgrade to the patched version (2.1.0b6+dfsg.3-4+deb7u5 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for extplorer →
FAQ
extplorer is a web-based file manager written in PHP, allowing users to manage files and directories on a server through a user-friendly interface.
The vulnerability allows an attacker to execute arbitrary commands on the server, potentially leading to unauthorized access, data leakage, and compromise of the entire system.
extplorer versions 2.1.9 and prior are affected by the CVE-2017-12756 vulnerability.
To fix the vulnerability, upgrade extplorer to version 2.1.0b6+dfsg.3-4+deb7u5 or later. Follow the provided instructions to apply the update.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for extplorer.
