PT-2020-14714 · Mida · Mida Eframework

Name of the Vulnerable Software and Affected Versions: Mida eFramework versions prior to 2.9.1 Description: The issue allows an attacker to achieve Remote Code Execution RCE with administrative root privileges due to an OS Command Injection. No authentication is required. Recommendations: For...

PT-2020-14715

Name of the Vulnerable Software and Affected Versions eFramework versions prior to 2.9.1 Description The issue allows for a change of the administrative password and access to restricted functionalities, such as code execution, due to a back door. Recommendations For versions prior to 2.9.1, upda...

PT-2020-14718

Name of the Vulnerable Software and Affected Versions Mida eFramework versions prior to 2.9.1 Description The issue is related to a SQL Injection that leads to Information Disclosure. No authentication is required to exploit this issue. The injection point is located in one of the authentication...

PT-2020-14712

Name of the Vulnerable Software and Affected Versions Mida eFramework versions prior to 2.9.1 Description Multiple Stored Cross Site Scripting XSS issues were found. Recommendations For versions prior to 2.9.1, update to version 2.9.1 or later to resolve the issue...

PT-2020-14713

Name of the Vulnerable Software and Affected Versions Mida eFramework versions prior to 2.9.1 Description A Reflected Cross Site Scripting XSS issue was found. This means an attacker could inject malicious scripts into a website, potentially affecting users who visit the site. Recommendations For...

PT-2020-14717

Name of the Vulnerable Software and Affected Versions eFramework versions prior to 2.9.1 Description The issue allows unauthenticated directory traversal using ../, which can potentially lead to unauthorized access to sensitive files and directories. Recommendations For versions prior to 2.9.1,...

CVE-2020-15924: Improper Neutralization of Special Elements used in an SQL Command

There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection point resides in one of the authentication parameters...

PT-2020-14716

Name of the Vulnerable Software and Affected Versions Mida eFramework version 2.9.0 Description The issue allows an attacker to achieve Remote Code Execution RCE with administrative root privileges through an OS Command Injection. Authentication is required to exploit this issue. Recommendations...

Mida Solutions eFramework ajaxreq.php Command Injection

This module exploits a command injection vulnerability in Mida Solutions eFramework version 2.9.0 and prior. The ajaxreq.php file allows unauthenticated users to inject arbitrary commands in the PARAM parameter to be executed as the apache user. The sudo configuration permits the apache user to...

CVE-2020-15918: Improper Neutralization of Input During Web Page Generation

Multiple Stored Cross Site Scripting XSS vulnerabilities were discovered in Mida eFramework through 2.9.0...

CVE-2020-15920: Improper Neutralization of Special Elements used in an OS Command

There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution RCE with administrative root privileges. No authentication is required...

CVE-2020-15922: Improper Neutralization of Special Elements used in an OS Command

There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution RCE with administrative root privileges. Authentication is required...

CVE-2020-15919: Improper Neutralization of Input During Web Page Generation

A Reflected Cross Site Scripting XSS vulnerability was discovered in Mida eFramework through 2.9.0...

CVE-2020-15921: Improper Authentication

Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution...

CVE-2020-15923: Improper Limitation of a Pathname to a Restricted Directory

Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal...

Mida Solutions eFramework 2.9.0 XSS / Code Execution / SQL Injection Vulnerabilities

Mida Solutions eFramework versions 2.9.0 and below suffer from command execution, cross site scripting, denial of service, remote SQL injection, and path traversal vulnerabilities. ============================================= Title: Mida Solutions eFramework Multiple Vulnerabilities Author: Andr...

File Upload Vulnerability in eFrameWork

eFrameWork is a development framework for B/S application and web development. A file upload vulnerability exists in eFrameWork, which can be exploited by an attacker to gain control of the web server...