Description
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely for data portability, to deploy and execute malicious code on the underlying application server host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| danielbrendel | hortusfox-web | < 6.1 | 6.1 |
References
- Official Patch patch issue-tracking
- HortusFox-Web v6.1 Release Notes release-notes
- VulnCheck Advisory third-party-advisory