Vulnerability-Lookup

CNVD-2018-04409

Vulnerability from cnvd - Published: 2018-03-06

Title

Minecraft Servers List Lite和Premium Minecraft Servers List未认证上传漏洞

Description

Minecraft Servers List Lite是一套用于显示Minecraft（我的世界）游戏服务器列表的脚本的精简版。Premium Minecraft Servers List是它的优质版本。 Minecraft Servers List Lite commit c1cd164之前的版本和Premium Minecraft Servers List 2.0.4之前的版本中的install.php文件存在安全漏洞，该漏洞源于程序在将数据库连接信息存储在connect.php文件之前，未能过滤输入。远程攻击者可借助‘database_server’、‘database_user’、‘database_name’或‘database_password’参数利用该漏洞执行任意的PHP代码。

Severity

高

Patch Name

Minecraft Servers List Lite和Premium Minecraft Servers List未认证上传漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://minecraft.net

Reference

https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/

Impacted products

Name
['Minecraft Servers List Lite Minecraft Servers List Lite <c1cd164', 'Minecraft Servers List Lite Premium Minecraft Servers List <2.0.4']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-5749"
    }
  },
  "description": "Minecraft Servers List Lite\u662f\u4e00\u5957\u7528\u4e8e\u663e\u793aMinecraft\uff08\u6211\u7684\u4e16\u754c\uff09\u6e38\u620f\u670d\u52a1\u5668\u5217\u8868\u7684\u811a\u672c\u7684\u7cbe\u7b80\u7248\u3002Premium Minecraft Servers List\u662f\u5b83\u7684\u4f18\u8d28\u7248\u672c\u3002\r\n\r\nMinecraft Servers List Lite commit c1cd164\u4e4b\u524d\u7684\u7248\u672c\u548cPremium Minecraft Servers List 2.0.4\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684install.php\u6587\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5728\u5c06\u6570\u636e\u5e93\u8fde\u63a5\u4fe1\u606f\u5b58\u50a8\u5728connect.php\u6587\u4ef6\u4e4b\u524d\uff0c\u672a\u80fd\u8fc7\u6ee4\u8f93\u5165\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u2018database_server\u2019\u3001\u2018database_user\u2019\u3001\u2018database_name\u2019\u6216\u2018database_password\u2019\u53c2\u6570\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u7684PHP\u4ee3\u7801\u3002",
  "discovererName": "unknwon",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://minecraft.net",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-04409",
  "openTime": "2018-03-06",
  "patchDescription": "Minecraft Servers List Lite\u662f\u4e00\u5957\u7528\u4e8e\u663e\u793aMinecraft\uff08\u6211\u7684\u4e16\u754c\uff09\u6e38\u620f\u670d\u52a1\u5668\u5217\u8868\u7684\u811a\u672c\u7684\u7cbe\u7b80\u7248\u3002Premium Minecraft Servers List\u662f\u5b83\u7684\u4f18\u8d28\u7248\u672c\u3002\r\n\r\nMinecraft Servers List Lite commit c1cd164\u4e4b\u524d\u7684\u7248\u672c\u548cPremium Minecraft Servers List 2.0.4\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684install.php\u6587\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5728\u5c06\u6570\u636e\u5e93\u8fde\u63a5\u4fe1\u606f\u5b58\u50a8\u5728connect.php\u6587\u4ef6\u4e4b\u524d\uff0c\u672a\u80fd\u8fc7\u6ee4\u8f93\u5165\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u2018database_server\u2019\u3001\u2018database_user\u2019\u3001\u2018database_name\u2019\u6216\u2018database_password\u2019\u53c2\u6570\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u7684PHP\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Minecraft Servers List Lite\u548cPremium Minecraft Servers List\u672a\u8ba4\u8bc1\u4e0a\u4f20\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Minecraft Servers List Lite Minecraft Servers List Lite \u003cc1cd164",
      "Minecraft Servers List Lite Premium Minecraft Servers List \u003c2.0.4"
    ]
  },
  "referenceLink": "https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/",
  "serverity": "\u9ad8",
  "submitTime": "2018-01-25",
  "title": "Minecraft Servers List Lite\u548cPremium Minecraft Servers List\u672a\u8ba4\u8bc1\u4e0a\u4f20\u6f0f\u6d1e"
}

CVE-2018-5749 (GCVE-0-2018-5749)

Vulnerability from cvelistv5 – Published: 2018-01-23 19:00 – Updated: 2024-08-05 05:40

Summary

install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

1 reference

URL	Tags
https://www.rastating.com/minecraft-servers-list-…	x_refsource_MISC

Date Public

2018-01-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T05:40:51.360Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-01-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-23T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-5749",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/",
              "refsource": "MISC",
              "url": "https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-5749",
    "datePublished": "2018-01-23T19:00:00.000Z",
    "dateReserved": "2018-01-17T00:00:00.000Z",
    "dateUpdated": "2024-08-05T05:40:51.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2018-04409

CVE-2018-5749 (GCVE-0-2018-5749)

Tags

Sightings

Nomenclature

Related by attack behaviour