PT-2025-13690 · Unknown · E-Solutions E-Management

Published 2025-03-31 · Updated 2025-03-31 · CVE-2025-3022

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions e-solutions e-management (affected versions not specified)

Description The issue is an OS command injection vulnerability that allows an attacker to execute arbitrary commands on the server. This is achieved via the client parameter in the "/data/apache/e-management/api/api3.php" endpoint.

Recommendations As a temporary workaround, consider restricting access to the "/data/apache/e-management/api/api3.php" endpoint to minimize the risk of exploitation. Avoid using the client parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-3022

Affected Products

E-Solutions E-Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-3022 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-e-management-e-solutions · Note
• https://twitter.com/CVEnew/status/1906669814405374396 · Twitter Post
• https://twitter.com/CveFindCom/status/1906670796342276210 · Twitter Post
• https://t.me/cvedetector/21579 · Telegram Post