PHP code execution in OCS inventory NG
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-14857 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
OCS inventory NG Client/Desktop applications / Software for system administration |
| Vendor | OCS inventory NG |
Security Bulletin
This security bulletin contains one high risk vulnerability.
1) PHP code injection
EUVDB-ID: #VU14193
Risk: High
CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-14857
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to execute arbitrary PHP code on the target system.
The weakness due to insufficient validation of user-supplied input. A remote attacker can upload a specially crafted template file containing PHP code and execute arbitrary PHP code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Install update from vendor's website.
Vulnerable software versionsOCS inventory NG: 2.3 - 2.5
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
