CVE-2020-11579

An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled.
References
Link Resource
https://github.com/ShielderSec/CVE-2020-11579 Exploit Third Party Advisory
https://shielder.it/ Third Party Advisory
https://www.phpkb.com Product
https://www.shielder.it/blog/mysql-and-cve-2020-11579-exploitation/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:chadhaajay:phpkb:9.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

History

13 Jun 2022, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://www.knowledgebase-script.com/', 'name': 'https://www.knowledgebase-script.com/', 'tags': ['Product', 'Vendor Advisory'], 'refsource': 'MISC'}
  • (MISC) https://www.phpkb.comĀ -
CWE CWE-20 CWE-306

Information

Published : 2020-09-03 18:15

Updated : 2024-02-04 21:00


NVD link : CVE-2020-11579

Mitre link : CVE-2020-11579

CVE.ORG link : CVE-2020-11579


JSON object : View

Products Affected

chadhaajay

  • phpkb

php

  • php
CWE
CWE-306

Missing Authentication for Critical Function