InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
Résumé
InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
Description d'origine
La description telle que publiée par la source (souvent en anglais).
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbitrary system commands on the server by manipulating the public_invoice_template setting to include poisoned log files containing PHP code. Version 1.7.1 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com