Description
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
thexerteproject xerteonlinetoolkits
Default version status: unaffected
0 to ≤ 3.15.5affected
References
- https://github.com/thexerteproject/xerteonlinetoolkits/issues/1557 ↗
- https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/functions.php#L419 ↗
- https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_code/php/language/import_language.php#L211 ↗
- https://github.com/thexerteproject/xerteonlinetoolkits ↗
- https://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import ↗