← Back

CVE-2018-5749

nvd nist
Published: Jan 23, 2018Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter.

Affected (2)

Premium Minecraft Servers List Project
1 product
Premium Minecraft Servers List
Minecraft Servers List Lite Project
1 product
Minecraft Servers List Lite
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Premium Minecraft Servers List
Before 2.0.4
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Minecraft Servers List Lite
Before 1.1

Related CWEs

CWE-434
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

Source: cve@mitre.org
ExploitMitigationPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMitigationPatchThird Party Advisory

Timeline

No history available yet.