CyberRota Analysis
AI-GeneratedThe MineAdmin backend management system prior to version 3.2.0-alpha.2 is vulnerable to a path traversal attack due to the app-store plugin service improperly handling user-supplied identifiers in file system paths. This flaw allows attackers to read, install, or uninstall plugins from arbitrary directories, potentially leading to the execution of arbitrary commands. Organizations using affected versions should prioritize upgrading to the patched version to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.