PT-2020-14714 · Mida · Mida Eframework

Andrea Baesso · Published 2020-07-24 · Updated 2023-01-20 · CVE-2020-15920

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mida eFramework versions prior to 2.9.1

Description The issue allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges due to an OS Command Injection. No authentication is required.

Recommendations For versions prior to 2.9.1, update to version 2.9.1 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-15920

Affected Products

Mida Eframework

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/mida_solutions_eframework_ajaxreq_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html · Exploit
• 🔥 https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html · Exploit
• 🔥 https://exploit-db.com/exploits/48768 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15920 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15920 · Vendor Advisory