CyberSec.Space Logo
Back to CVE Browser

CVE-2018-1000124

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0030%
EPSS Percentile19.65th
PublishedMar 13, 2018
Last ModifiedDec 5, 2025

Vulnerability Description

I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter form_import_textarea.

Affected Platforms (CPE)

📦
Scilico

I\, Librarian

<= 4.8

References & Advisories

🔗 https://github.com/mkucej/i-librarian/issues/116
🔗 https://github.com/mkucej/i-librarian/issues/116

Related Vulnerabilities

CVE-2017-10002379.8

I, Librarian version <=4.6 & 4.7 is vulnerable to Server-Side Request Forgery in the ajaxsupplement.php resulting in the attacker ...

CVE-2017-10002359.8

I, Librarian version <=4.6 & 4.7 is vulnerable to OS Command Injection in batchimport.php resulting the web server being fully com...

CVE-2018-10001419.1

I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in a...

CVE-2018-10001389.1

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can resu...