CVEvulnerability
CVE-2020-15920
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-07-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.
Affected configurations
• midasolutions eframework (<= 2.9.0)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html Exploit, Third Party Advisory, VDB Entry
- https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html Exploit, Third Party Advisory, VDB Entry
- https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html Exploit, Third Party Advisory