Mida eFramework 漏洞列表

Mida eFramework through 2.9.0 allows an attacker to achieve remote code execution with administrative (root) privileges. No authentication is required.

Mida eFramework through 2.9.0 allows an attacker to achieve remote code execution with administrative (root) privileges. No authentication is required.

Mida eFramework contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Mida eFramework /PDC/download.php存在任意文件读取漏洞，攻击者可通过该漏洞获取敏感信息。

Mida eFramework到2.9.0版本中存在操作系统命令注入，允许攻击者以管理（root）权限实现远程代码执行（RCE）。