Submit #552264: elunez eladmin 2.7.18<= Read any file
| Titel | elunez eladmin 2.7.18<= Read any file |
|---|---|
| Beschreibung | The arbitrary file reading vulnerability caused by misconfigured MySQL connection parameters poses a significant security risk. This vulnerability occurs when applications allow users to control MySQL connection parameters (such as server address, username, password, etc.), where attackers can exploit specific parameters (especially the LOAD DATA LOCAL INFILE functionality) to read sensitive files on the server. This vulnerability exists in all versions of the eladmin system, allowing attackers to access sensitive files by manipulating database connection configurations. When the eladmin application fails to strictly validate and filter these parameters, attackers can construct special connection requests that induce the server to read and return arbitrary file contents, resulting in sensitive information leakage and seriously threatening system security. Protective measures include updating eladmin to patched versions, disabling the LOCAL INFILE functionality, restricting user control of connection parameters, and implementing strict input validation. |
| Quelle | ⚠️ https:/ |
| Benutzer | 1940dd (UID 83805) |
| Einreichung | 06.04.2025 17:55 (vor 1 Jahr) |
| Moderieren | 07.04.2025 08:23 (14 hours later) |
| Status | Duplikat |
| VulDB Eintrag | 303320 [elunez eladmin 2.7 Maintenance Management testConnect erweiterte Rechte] |
| Punkte | 0 |