logo

Database

OS Command Injection In studio-42/elfinder

Description

elFinder command injection vulnerability in the PHP connector elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2019-91942. NVD-2019-91943. OSV-2019-91944. GCVE-2019-9194

References

1. https://github.com/Studio-42/elFinder/commit/374c88d7030eb92749267e17a4af21cc7520efa52. https://github.com/FriendsOfPHP/security-advisories/blob/master/studio-42/elfinder/CVE-2019-9194.yaml3. https://github.com/Studio-42/elFinder/blob/master/README.md4. https://github.com/Studio-42/elFinder/compare/6884c4f...07400285. https://github.com/Studio-42/elFinder/releases/tag/2.1.486. https://www.exploit-db.com/exploits/464817. https://www.exploit-db.com/exploits/465398. https://vulncheck.com/cve/CVE-2019-91949. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9194.yaml10. https://github.com/cved-sources/cve-2019-919411. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/elfinder_php_connector_exiftran_cmd_injection.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.