exploitDog

CVE-2021-42897

Опубликовано: 16 мая 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $mysqlstr and is executed by exec.

Ссылки

https://github.com/FeMiner/wms/issues/12
Exploit
Issue Tracking
Third Party Advisory
https://github.com/FeMiner/wms/issues/12
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:feminer_wms_project:feminer_wms:1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.07063

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-j76v-x5jp-f9gj

CVSS3: 9.8

github

больше 3 лет назад

A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $mysqlstr and is executed by exec.

EPSS

Процентиль: 91%

0.07063

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-78