CoreCVE
Back

CRITICAL

install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter

Published Jan 23, 2018

Description

install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jan 23, 2018
Updated Aug 5, 2024
Reserved Jan 17, 2018
Link CVE-2018-5749
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-5749
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-5749