漏洞描述
Mida eFramework through 2.9.0 allows an attacker to achieve remote code execution with administrative (root) privileges. No authentication is required.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
elbae.github.iohttps://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html↗packetstormsecurity.comhttp://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html↗packetstormsecurity.comhttp://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-15920↗