PT-2017-17617 · Emli · Emli University Management+2

Yash Mehta · Published 2017-03-29 · Updated 2017-04-10 · CVE-2017-7258

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions eMLi School Management version 1.0 eMLi College Campus Management version 1.0 eMLi University Management version 1.0

Description The issue allows an attacker to view restricted information or execute powerful commands on the web server, potentially leading to a full system compromise via Directory Path Traversal. This can be demonstrated by reading core-emli/Storage.

Recommendations For eMLi School Management version 1.0, restrict access to sensitive directories to minimize the risk of exploitation. For eMLi College Campus Management version 1.0, consider implementing proper input validation and sanitization to prevent Directory Path Traversal attacks. For eMLi University Management version 1.0, limit the execution of powerful commands on the web server to authorized personnel only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-7258

Affected Products

Emli College Campus Management

Emli School Management

Emli University Management

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-7258 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7258 · Vendor Advisory
• https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html · Note
• http://securityfocus.com/bid/97255 · Note