Midasolutions Eframework vulnerabilities

CVE-2020-15920 [CRITICAL] CWE-78 CVE-2020-15920: There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.

CVE-2020-15922 [CRITICAL] CWE-78 CVE-2020-15922: There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. Authentication is required.

CVE-2020-15921 [CRITICAL] CWE-287 CVE-2020-15921: Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password a Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution.

CVE-2020-15923 [HIGH] CWE-22 CVE-2020-15923: Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal. Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.

CVE-2020-15924 [HIGH] CWE-89 CVE-2020-15924: There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No a There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection point resides in one of the authentication parameters.

CVE-2020-15918 [MEDIUM] CWE-79 CVE-2020-15918: Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework throug Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0.

CVE-2020-15919 [MEDIUM] CWE-79 CVE-2020-15919: A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0 A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.