An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled.
References
Link | Resource |
---|---|
https://github.com/ShielderSec/CVE-2020-11579 | Exploit Third Party Advisory |
https://shielder.it/ | Third Party Advisory |
https://www.phpkb.com | Product |
https://www.shielder.it/blog/mysql-and-cve-2020-11579-exploitation/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
13 Jun 2022, 16:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
CWE | CWE-306 |
Information
Published : 2020-09-03 18:15
Updated : 2024-02-04 21:00
NVD link : CVE-2020-11579
Mitre link : CVE-2020-11579
CVE.ORG link : CVE-2020-11579
JSON object : View
Products Affected
chadhaajay
- phpkb
php
- php
CWE
CWE-306
Missing Authentication for Critical Function