InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
概要
InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbitrary system commands on the server by manipulating the public_invoice_template setting to include poisoned log files containing PHP code. Version 1.7.1 patches the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com