Описание
NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:nedi:nedi:1.9c:*:*:*:*:*:*:*
EPSS
Процентиль: 68%
0.00582
Низкий
9.9 Critical
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-863
Связанные уязвимости
CVSS3: 9.9
github
больше 3 лет назад
NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.
EPSS
Процентиль: 68%
0.00582
Низкий
9.9 Critical
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-863