CVE-2020-36897
BaseFortify
Publication date: 2025-12-10
Last updated on: 2025-12-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| howfor | qihang_media_web_digital_signage | 3.0.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in QiHang Media Web Digital Signage 3.0.9, specifically in the QH.aspx file. It allows an unauthenticated attacker to remotely execute code by uploading malicious ASPX scripts through the file upload functionality. The attacker exploits the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute arbitrary system commands on the affected server without authentication. This can lead to full compromise of the server, including data theft, data loss, service disruption, or using the server as a foothold for further attacks.