CVE-2020-15924

CVE-2020-15924 : The vulnerability affects Mida eFramework versions up to 2.9.0. It is a SQL injection vulnerability in one of the authentication parameters, with no authentication required. The impact is information disclosure . The connected documents confirm the root cause as an injectable que...

CVE-2020-15924: Improper Neutralization of Special Elements used in an SQL Command

There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection point resides in one of the authentication parameters...

CVE-2020-15919: Improper Neutralization of Input During Web Page Generation

A Reflected Cross Site Scripting XSS vulnerability was discovered in Mida eFramework through 2.9.0...

CVE-2020-15923: Improper Limitation of a Pathname to a Restricted Directory

Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal...

PT-2020-14714 · Mida · Mida Eframework

Name of the Vulnerable Software and Affected Versions: Mida eFramework versions prior to 2.9.1 Description: The issue allows an attacker to achieve Remote Code Execution RCE with administrative root privileges due to an OS Command Injection. No authentication is required. Recommendations: For...

CVE-2020-15918: Improper Neutralization of Input During Web Page Generation

Multiple Stored Cross Site Scripting XSS vulnerabilities were discovered in Mida eFramework through 2.9.0...

Mida Solutions eFramework ajaxreq.php Command Injection

This module exploits a command injection vulnerability in Mida Solutions eFramework version 2.9.0 and prior. The ajaxreq.php file allows unauthenticated users to inject arbitrary commands in the PARAM parameter to be executed as the apache user. The sudo configuration permits the apache user to...

CVE-2020-15920: Improper Neutralization of Special Elements used in an OS Command

There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution RCE with administrative root privileges. No authentication is required...

CVE-2020-15921: Improper Authentication

Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution...

CVE-2020-15922: Improper Neutralization of Special Elements used in an OS Command

There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution RCE with administrative root privileges. Authentication is required...

Mida Solutions eFramework 2.9.0 XSS / Code Execution / SQL Injection Vulnerabilities

Mida Solutions eFramework versions 2.9.0 and below suffer from command execution, cross site scripting, denial of service, remote SQL injection, and path traversal vulnerabilities. ============================================= Title: Mida Solutions eFramework Multiple Vulnerabilities Author: Andr...