CVE-2017-11718 : Security Advisory and Response

MetInfo through version 5.3.17 is vulnerable to URL Redirector Abuse in the member/login.php page.

Understanding CVE-2017-11718

This CVE involves a security issue in MetInfo that allows for URL Redirector Abuse.

What is CVE-2017-11718?

The gourl parameter in MetInfo through version 5.3.17 enables attackers to abuse URL redirection on the member/login.php page.

The Impact of CVE-2017-11718

This vulnerability can be exploited by malicious actors to redirect users to malicious websites, potentially leading to phishing attacks or the installation of malware.

Technical Details of CVE-2017-11718

MetInfo version 5.3.17 is susceptible to URL Redirector Abuse due to the gourl parameter in the member/login.php page.

Vulnerability Description

The gourl parameter in MetInfo allows unauthorized parties to redirect users to external sites.

Affected Systems and Versions

Product: MetInfo
Vendor: N/A
Versions: up to 5.3.17

Exploitation Mechanism

Attackers can craft malicious URLs containing the gourl parameter to redirect users to harmful websites.

Mitigation and Prevention

To address CVE-2017-11718, follow these mitigation strategies:

Immediate Steps to Take

Disable the gourl parameter in MetInfo configurations.
Educate users about the risks of clicking on unknown URLs.

Long-Term Security Practices

Regularly update MetInfo to the latest version to patch known vulnerabilities.
Implement URL filtering mechanisms to block suspicious redirects.
Conduct security audits to identify and address similar issues.

Patching and Updates

Apply patches or updates provided by MetInfo to fix the URL Redirector Abuse vulnerability.