PT-2021-19199 · Evolucare · Evolucare Ecsimaging

Shoxxdj · Published 2021-01-11 · Updated 2024-08-03 · CVE-2021-3118

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EVOLUCARE ECSIMAGING (aka ECS Imaging) versions 6.21.5 and earlier

Description The issue affects the login form and the password-forgotten form, such as /req password user.php?email=, allowing an attacker to steal data in the database and obtain access to the application. The database component runs as root. This issue only affects products that are no longer supported by the maintainer.

Recommendations For EVOLUCARE ECSIMAGING versions 6.21.5 and earlier, consider disabling the login form and the password-forgotten form as a temporary workaround until a patch is available. Restrict access to the /req password user.php endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-3118

Affected Products

Evolucare Ecsimaging

References · 6

• 🔥 https://exploit-db.com/exploits/49392 · Exploit
• https://osv.dev/vulnerability/CVE-2021-3118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3118 · Security Note
• https://t.me/cibsecurity/21899 · Telegram Post
• https://t.me/cvenotify/8407 · Telegram Post
• https://t.me/cvenotify/8397 · Telegram Post