PT-2021-18698 · Evolucare · Evolucare Ecsimaging

Published 2021-01-07 · Updated 2024-08-03 · CVE-2021-3029

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EVOLUCARE ECSIMAGING (aka ECS Imaging) versions 6.21.5 and earlier

Description The issue is related to an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The file parameter on the webpage "/showfile.php" can be exploited to gain root access. This vulnerability only affects products that are no longer supported by the maintainer.

Recommendations For EVOLUCARE ECSIMAGING versions 6.21.5 and earlier, as a temporary workaround, consider disabling the "/showfile.php" webpage or restricting access to the file parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-3029

Affected Products

Evolucare Ecsimaging

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-3029 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3029 · Vendor Advisory
• https://evolucare.com · Note
• https://shoxxdj.fr/ecsimaging-os-injection-cve-2021-3029 · Note
• https://t.me/cvenotify/88808 · Telegram Post
• https://t.me/cibsecurity/21745 · Telegram Post