CVE-2018-17984

An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access.

An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access.

Una expresión regular /[a-z]{2}/ no anclada en ISPConfig en versiones anteriores a la 3.1.13 hace posible incluir archivos arbitrarios, conduciendo a una ejecución de código. Esto es explotable por usuarios autentificados que tienen acceso al sistema de archivos local.