Description
Chevereto 3.13.4 Core contains a remote code execution vulnerability that allows attackers to inject malicious code during database configuration installation. Attackers can manipulate the database table prefix parameter to write a PHP shell file and execute arbitrary system commands through a crafted POST request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Chevere SpA | Chevereto | <= 3.13.4 | — |
References
- ExploitDB-47903 exploit
- Chevereto Official Homepage product
- Chevereto Free GitHub Releases product
- VulnCheck Advisory: Chevereto 3.13.4 Core - Remote Code Execution third-party-advisory