CVE-2017-12756
HighSummary
In extplorer versions 2.1.9 and prior, there is a command injection vulnerability in the transfer function from another server, allowing an attacker to inject commands via the userfile[0] parameter.
Risk Assessment
An attacker can exploit this vulnerability to execute unauthorized commands on the server, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to the latest version of extplorer to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in extplorer
See all- CVE-2016-4313High
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archive file.
- CVE-2025-13058Low
A cross-site scripting vulnerability was discovered in soerennb eXtplorer up to 2.1.15 in the Filename Handler component. The attack can be launched remotely and a patch is available as commit 002def70b985f7012586df2c44368845bf405ab3.
Original NVD description (English source)
Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile[0] parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS