CVE-2017-9741

install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-06-18

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Projectsend (Projectsend)

References

• https://github.com/XiaoZhis/ProjectSend/issues/1