CVE-2021-36121

Echo ShareCare 8.15.5 contains an unrestricted file upload vulnerability in Access/DownloadFeed_Mnt/FileUpload_Upd.cfm, exploitable via the name1 parameter. Processing remote input from an authenticated user allows writing arbitrary files to arbitrary filesystem locations through ../ Directory Tr...

CVE-2021-36124

CVE-2021-36124 affects Echo ShareCare 8.15.5. The root cause is missing authentication/authorization checks when accessing a subset of sensitive resources, allowing unauthenticated users to reach pages that are vulnerable to attacks such as SQL injection. The impact, as described, is that access ...

CVE-2021-36123

The CVE concerns Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is vulnerable to local file inclusion when processing remote input in the textFile parameter from an authenticated user. This allows reading arbitrary files on the server filesystem and any files a...

CVE-2021-36122

Echo ShareCare 8.15.5 contains a command argument injection in the UnzipFile feature (Access/EligFeedParse_Sup/UnzipFile_Upd.cfm) where remote input in the zippass parameter from an authenticated user can inject arbitrary arguments to 7z.exe. This is the concrete vulnerability described across CV...

CVE-2021-33578

Echo ShareCare 8.15.5 is affected by CVE-2021-33578 due to an SQL injection vulnerability in processing remote input from both authenticated and unauthenticated users. The vulnerability can allow bypassing authentication, exfiltrating SQL records, and manipulating data. References corroborate the...