CVE-2019-11062 - SUNNET WMPro v5.0 and v5.1 has OS Command Injection

Back Back to CVE browser

CRITICAL

SUNNET WMPro v5.0 and v5.1 has OS Command Injection

Published Jul 11, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 5.70%

Description

The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.

Affected products

Vendor Sunnet Product WMPro Default
n/a
- Version
  5.0
  Status
  affected
  Constraints
  -
- Version
  5.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sunnet

WMPro

n/a

Version	Status	Constraints
5.0	affected	-
5.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

http://surl.twcert.org.tw/hLFFM
x_refsource_CONFIRMBroken Link
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2770
Advisory
https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0
x_refsource_CONFIRMExploitThird Party Advisory
https://tvn.twcert.org.tw/taiwanvn/TVN-201906001
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
http://surl.twcert.org.tw/hLFFM		x_refsource_CONFIRMBroken Link
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2770		Advisory
https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0		x_refsource_CONFIRMExploitThird Party Advisory
https://tvn.twcert.org.tw/taiwanvn/TVN-201906001		x_refsource_CONFIRMThird Party Advisory