Description (CNA)
HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| zelon88 / HRConvert2 | affected < 3.3.8 |
CWE
CWE-78
References
- https://github.com/zelon88/HRConvert2/security/advisories/GHSA-f74g-4wj8-j35h
- https://github.com/zelon88/HRConvert2/releases/tag/v3.3.8
ADP enrichment
No English description supplied.