PT-2019-13244 · Arox · Arox School Erp Pro

Akkus + 1 · Publicado 2019-07-04 · Atualizado 2020-08-24 · CVE-2019-13294

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AROX School-ERP Pro (affected versions not specified)

Description The issue concerns a command execution vulnerability. Specifically, the import stud.php and upload file.php files lack session control, allowing an unauthenticated user to execute commands on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Improper Authentication

Enumeração de Fraquezas

CWE-434

CWE-287

Identificadores relacionados

CVE-2019-13294

Produtos afetados

Arox School Erp Pro

Referências · 4

• 🔥 https://exploit-db.com/exploits/46999 · Exploit
• 🔥 http://pentest.com.tr/exploits/AROX-School-ERP-Pro-Unauthenticated-RCE-Metasploit.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13294 · Nota de Segurança
• https://t.me/cvenotify/216 · Publicação no Telegram