PT-2019-13244 · Arox · Arox School Erp Pro

Akkus + 1 · Published 2019-07-04 · Updated 2020-08-24 · CVE-2019-13294

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AROX School-ERP Pro (affected versions not specified)

Description The issue concerns a command execution vulnerability. Specifically, the import stud.php and upload file.php files lack session control, allowing an unauthenticated user to execute commands on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Improper Authentication

Weakness Enumeration

CWE-434

CWE-287

Related Identifiers

CVE-2019-13294

Affected Products

Arox School Erp Pro

References · 4

• 🔥 https://exploit-db.com/exploits/46999 · Exploit
• 🔥 http://pentest.com.tr/exploits/AROX-School-ERP-Pro-Unauthenticated-RCE-Metasploit.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13294 · Security Note
• https://t.me/cvenotify/216 · Telegram Post