Main
Vulnerability Database
Exploits
ID:3809 - Exploit for Improper Neutralization of Special Elements in Output Used by a Downstream Component in PEAR - CVE-2017-5630
ID:3809 - Exploit for Improper Neutralization of Special Elements in Output Used by a Downstream Component in PEAR - CVE-2017-5630
Published: August 9, 2020
Vulnerability identifier: #VU39753
Vulnerability risk: Medium
CVE-ID: CVE-2017-5630
CWE-ID: CWE-74
Exploitation vector: Remote access
Vulnerable software:
PEAR
PEAR
Link to public exploit:
Vulnerability description
The vulnerability allows a remote non-authenticated attacker to manipulate data.
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
Remediation
Install update from vendor's website.