PT-2020-12868 · Rukovoditel · Rukovoditel

Published 2020-04-16 · Updated 2021-07-21 · CVE-2020-11819

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rukovoditel version 2.5.2

Description The issue allows an attacker to inject an arbitrary .php file location, potentially leading to command execution.

Recommendations For Rukovoditel version 2.5.2, consider restricting access to language file parameters to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-11819

Affected Products

Rukovoditel

References · 5

• 🔥 https://exploit-db.com/exploits/49238 · Exploit
• 🔥 https://exploit-db.com/exploits/48784 · Exploit
• 🔥 https://fatihhcelik.blogspot.com/2020/01/rukovoditel-rce-via.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11819 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11819 · Vendor Advisory