A Plug-in to Detect the SQL Injection Vulnerability in the MetInfo Frontend Is Available
Oct 17 2018
On October 16, 2018, Alibaba Cloud Security Emergency Response Center detected that a security researcher disclosed a SQL injection vulnerability in the frontend of MetInfo 6.1.2 (the latest version).
Content
Target customers: users who run websites based on MetInfo and Mituo. Features released: On October 16, 2018, Alibaba Cloud Security Emergency Response Center detected that a security researcher disclosed a SQL injection vulnerability in the frontend of MetInfo 6.1.2 (the latest version). Attackers can create malicious SQL statements to exploit this vulnerability and obtain sensitive information and permissions on the website database. Vulnerability description: The id parameter is not filtered in the metinfo6.1.2/app/system/message/web/message.class.php file, resulting in an SQL injection vulnerability. Vulnerability severity: critical (CNVD-2018-20024) Impact scope: MetInfo 6.1.2.