CVE-2018-17408

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file that is accessed through the Import CSV File menu.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.spentera.id/zahir-accounting-enterprise-plus-6/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/45505/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45560/Exploit, Third Party Advisory, VDB Entry
https://blog.spentera.id/zahir-accounting-enterprise-plus-6/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/45505/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45560/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Oct 3, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-17416.5IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cau CVE-2018-174109.8Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI.CVE-2018-174119.8An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.CVE-2018-174129.8zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.CVE-2018-174136.1XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.CVE-2018-174148.8zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.CVE-2018-174158.8zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.CVE-2018-174167.2A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.CVE-2018-174187.2Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP file CVE-2018-174197.5An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a CVE-2018-17429.3IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses f CVE-2018-174207.2An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords paramet