CVE-2020-36897: QiHang Media Web Digital Signage 3.0.9 Unauthenticated Remote Code Execution
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36897?
CVE-2020-36897 has a high severity rating due to its ability to allow unauthenticated remote code execution.
How do I fix CVE-2020-36897?
To fix CVE-2020-36897, ensure you update to the latest version of QiHang Media Web Digital Signage that contains security patches addressing this vulnerability.
What type of attack can exploit CVE-2020-36897?
CVE-2020-36897 can be exploited through an attack that allows an attacker to upload malicious ASPX scripts remotely.
Is authentication required to exploit CVE-2020-36897?
No, CVE-2020-36897 can be exploited without authentication, making it particularly dangerous.
What components of QiHang Media Web Digital Signage are affected by CVE-2020-36897?
The vulnerability affects the QH.aspx file, which is part of the QiHang Media Web Digital Signage application.