CVE-2020-36898: QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36898?
CVE-2020-36898 is classified as a high severity vulnerability due to its ability to allow unauthenticated file deletion by remote attackers.
How do I fix CVE-2020-36898?
To fix CVE-2020-36898, ensure that the QH.aspx endpoint is properly secured by implementing authentication and authorization checks for file deletion requests.
What impact does CVE-2020-36898 have on my system?
CVE-2020-36898 can result in the loss of critical files, disruption of service, and potential exploitation of the system by unauthorized users.
Which software versions are affected by CVE-2020-36898?
CVE-2020-36898 affects QiHang Media Web Digital Signage version 3.0.9.
Can CVE-2020-36898 be exploited remotely?
Yes, CVE-2020-36898 can be exploited remotely by sending a specially crafted POST request to the vulnerable endpoint.