cve/2017/CVE-2017-11366.md

CVE-2017-11366

Description

components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.

POC

Reference

• http://www.jianshu.com/p/41ac7ac2a7af

Github

• https://github.com/WangYihang/Codiad-Remote-Code-Execute-Exploit
• https://github.com/WangYihang/Exploit-Framework
• https://github.com/hidog123/Codiad-CVE-2018-14009