Search criteria
9 vulnerabilities found for wmpro by sun.net
FKIE_CVE-2023-35851
Vulnerability from fkie_nvd - Published: 2023-09-18 03:15 - Updated: 2024-11-21 08:08
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.
References
| URL | Tags | ||
|---|---|---|---|
| twcert@cert.org.tw | https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html | Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun.net:wmpro:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A6868DAD-1076-4242-95D1-92E0B11B6F92",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nSUNNET WMPro portal\u0027s FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.\n\n"
},
{
"lang": "es",
"value": "La funci\u00f3n de preguntas frecuentes del portal SUNNET WMPro no tiene una validaci\u00f3n suficiente para la entrada del usuario. Un atacante remoto no autenticado puede inyectar comandos SQL arbitrarios para obtener informaci\u00f3n sensible a trav\u00e9s de una base de datos. "
}
],
"id": "CVE-2023-35851",
"lastModified": "2024-11-21T08:08:49.380",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "twcert@cert.org.tw",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-09-18T03:15:08.017",
"references": [
{
"source": "twcert@cert.org.tw",
"tags": [
"Third Party Advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html"
}
],
"sourceIdentifier": "twcert@cert.org.tw",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "twcert@cert.org.tw",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-35850
Vulnerability from fkie_nvd - Published: 2023-09-18 03:15 - Updated: 2024-11-21 08:08
Severity ?
Summary
SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.
References
| URL | Tags | ||
|---|---|---|---|
| twcert@cert.org.tw | https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html | Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun.net:wmpro:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A6868DAD-1076-4242-95D1-92E0B11B6F92",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nSUNNET WMPro portal\u0027s file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.\n\n"
},
{
"lang": "es",
"value": "La funci\u00f3n de administraci\u00f3n de archivos del portal SUNNET WMPro tiene una vulnerabilidad de filtrado insuficiente para la entrada del usuario. Un atacante remoto con privilegios de administrador o una cuenta privilegiada puede aprovechar esta vulnerabilidad para inyectar y ejecutar comandos arbitrarios del sistema para realizar operaciones arbitrarias del sistema o interrumpir el servicio. "
}
],
"id": "CVE-2023-35850",
"lastModified": "2024-11-21T08:08:49.250",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "twcert@cert.org.tw",
"type": "Secondary"
}
]
},
"published": "2023-09-18T03:15:07.590",
"references": [
{
"source": "twcert@cert.org.tw",
"tags": [
"Third Party Advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html"
}
],
"sourceIdentifier": "twcert@cert.org.tw",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "twcert@cert.org.tw",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2019-11062
Vulnerability from fkie_nvd - Published: 2019-07-11 19:15 - Updated: 2024-11-21 04:20
Severity ?
Summary
The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.
References
| URL | Tags | ||
|---|---|---|---|
| twcert@cert.org.tw | http://surl.twcert.org.tw/hLFFM | Broken Link | |
| twcert@cert.org.tw | https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0 | Exploit, Third Party Advisory | |
| twcert@cert.org.tw | https://tvn.twcert.org.tw/taiwanvn/TVN-201906001 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://surl.twcert.org.tw/hLFFM | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://tvn.twcert.org.tw/taiwanvn/TVN-201906001 | Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun.net:wmpro:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A6868DAD-1076-4242-95D1-92E0B11B6F92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sun.net:wmpro:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AB03C9BF-C0B5-422F-B0B0-75FA79F8FC67",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via \"/teach/course/doajaxfileupload.php\". The target server can be exploited without authentication."
},
{
"lang": "es",
"value": "El sistema SUNNET WMPro v5.0 y v5.1 para eLearning tiene la inyecci\u00f3n de comandos del sistema operativo a trav\u00e9s de \"/teach/course/doajaxfileupload.php\". El servidor de destino se puede explotar sin autenticaci\u00f3n"
}
],
"id": "CVE-2019-11062",
"lastModified": "2024-11-21T04:20:27.863",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-11T19:15:12.860",
"references": [
{
"source": "twcert@cert.org.tw",
"tags": [
"Broken Link"
],
"url": "http://surl.twcert.org.tw/hLFFM"
},
{
"source": "twcert@cert.org.tw",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0"
},
{
"source": "twcert@cert.org.tw",
"tags": [
"Third Party Advisory"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://surl.twcert.org.tw/hLFFM"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001"
}
],
"sourceIdentifier": "twcert@cert.org.tw",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "twcert@cert.org.tw",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2023-35851 (GCVE-0-2023-35851)
Vulnerability from cvelistv5 – Published: 2023-09-18 02:33 – Updated: 2024-09-25 15:44
VLAI?
Title
SUNNET WMPro - SQL Injection
Summary
SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.
Severity ?
7.5 (High)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:30:45.439Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-25T15:44:25.973522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-25T15:44:38.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WMPro",
"vendor": "SUNNET",
"versions": [
{
"status": "affected",
"version": "V5"
}
]
}
],
"datePublic": "2023-09-18T02:32:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSUNNET WMPro portal\u0027s FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.\u003c/span\u003e\n\n"
}
],
"value": "\nSUNNET WMPro portal\u0027s FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-18T02:33:59.550Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the version to the latest or contact the SUNNET support team"
}
],
"value": "Update the version to the latest or contact the SUNNET support team"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SUNNET WMPro - SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-35851",
"datePublished": "2023-09-18T02:33:59.550Z",
"dateReserved": "2023-06-19T02:28:47.605Z",
"dateUpdated": "2024-09-25T15:44:38.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35850 (GCVE-0-2023-35850)
Vulnerability from cvelistv5 – Published: 2023-09-18 02:30 – Updated: 2024-09-25 15:45
VLAI?
Title
SUNNET WMPro - Command Injection
Summary
SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:30:45.382Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-25T15:45:04.933934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-25T15:45:21.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WMPro",
"vendor": "SUNNET",
"versions": [
{
"status": "affected",
"version": "V5"
}
]
}
],
"datePublic": "2023-09-18T02:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSUNNET WMPro portal\u0027s file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.\u003c/span\u003e\n\n"
}
],
"value": "\nSUNNET WMPro portal\u0027s file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-18T02:36:51.501Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update firmware version to latest or contact support team of SUNNET"
}
],
"value": "Update firmware version to latest or contact support team of SUNNET"
}
],
"source": {
"advisory": "TVN-202309012",
"discovery": "EXTERNAL"
},
"title": "SUNNET WMPro - Command Injection",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-35850",
"datePublished": "2023-09-18T02:30:35.609Z",
"dateReserved": "2023-06-19T02:28:47.605Z",
"dateUpdated": "2024-09-25T15:45:21.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11062 (GCVE-0-2019-11062)
Vulnerability from cvelistv5 – Published: 2019-07-11 18:22 – Updated: 2024-09-17 00:40
VLAI?
Title
SUNNET WMPro v5.0 and v5.1 has OS Command Injection
Summary
The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.
Severity ?
No CVSS data available.
CWE
- CWE-78 - OS Command Injection
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Credits
Tony Kuo
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:40:16.252Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://surl.twcert.org.tw/hLFFM"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WMPro",
"vendor": "SUNNET",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"status": "affected",
"version": "5.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tony Kuo"
}
],
"datePublic": "2019-07-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via \"/teach/course/doajaxfileupload.php\". The target server can be exploited without authentication."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-11T18:22:06",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://surl.twcert.org.tw/hLFFM"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SUNNET WMPro v5.0 and v5.1 has OS Command Injection",
"x_generator": {
"engine": "Vulnogram 0.0.7"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2019-07-01T16:00:00.000Z",
"ID": "CVE-2019-11062",
"STATE": "PUBLIC",
"TITLE": "SUNNET WMPro v5.0 and v5.1 has OS Command Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "WMPro",
"version": {
"version_data": [
{
"version_value": "5.0"
},
{
"version_value": "5.1"
}
]
}
}
]
},
"vendor_name": "SUNNET"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tony Kuo"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via \"/teach/course/doajaxfileupload.php\". The target server can be exploited without authentication."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.7"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001",
"refsource": "CONFIRM",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001"
},
{
"name": "http://surl.twcert.org.tw/hLFFM",
"refsource": "CONFIRM",
"url": "http://surl.twcert.org.tw/hLFFM"
},
{
"name": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0",
"refsource": "CONFIRM",
"url": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2019-11062",
"datePublished": "2019-07-11T18:22:06.876236Z",
"dateReserved": "2019-04-09T00:00:00",
"dateUpdated": "2024-09-17T00:40:32.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35851 (GCVE-0-2023-35851)
Vulnerability from nvd – Published: 2023-09-18 02:33 – Updated: 2024-09-25 15:44
VLAI?
Title
SUNNET WMPro - SQL Injection
Summary
SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.
Severity ?
7.5 (High)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:30:45.439Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-25T15:44:25.973522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-25T15:44:38.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WMPro",
"vendor": "SUNNET",
"versions": [
{
"status": "affected",
"version": "V5"
}
]
}
],
"datePublic": "2023-09-18T02:32:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSUNNET WMPro portal\u0027s FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.\u003c/span\u003e\n\n"
}
],
"value": "\nSUNNET WMPro portal\u0027s FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-18T02:33:59.550Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the version to the latest or contact the SUNNET support team"
}
],
"value": "Update the version to the latest or contact the SUNNET support team"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SUNNET WMPro - SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-35851",
"datePublished": "2023-09-18T02:33:59.550Z",
"dateReserved": "2023-06-19T02:28:47.605Z",
"dateUpdated": "2024-09-25T15:44:38.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35850 (GCVE-0-2023-35850)
Vulnerability from nvd – Published: 2023-09-18 02:30 – Updated: 2024-09-25 15:45
VLAI?
Title
SUNNET WMPro - Command Injection
Summary
SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:30:45.382Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-25T15:45:04.933934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-25T15:45:21.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WMPro",
"vendor": "SUNNET",
"versions": [
{
"status": "affected",
"version": "V5"
}
]
}
],
"datePublic": "2023-09-18T02:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSUNNET WMPro portal\u0027s file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.\u003c/span\u003e\n\n"
}
],
"value": "\nSUNNET WMPro portal\u0027s file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-18T02:36:51.501Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update firmware version to latest or contact support team of SUNNET"
}
],
"value": "Update firmware version to latest or contact support team of SUNNET"
}
],
"source": {
"advisory": "TVN-202309012",
"discovery": "EXTERNAL"
},
"title": "SUNNET WMPro - Command Injection",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-35850",
"datePublished": "2023-09-18T02:30:35.609Z",
"dateReserved": "2023-06-19T02:28:47.605Z",
"dateUpdated": "2024-09-25T15:45:21.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11062 (GCVE-0-2019-11062)
Vulnerability from nvd – Published: 2019-07-11 18:22 – Updated: 2024-09-17 00:40
VLAI?
Title
SUNNET WMPro v5.0 and v5.1 has OS Command Injection
Summary
The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.
Severity ?
No CVSS data available.
CWE
- CWE-78 - OS Command Injection
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Credits
Tony Kuo
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:40:16.252Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://surl.twcert.org.tw/hLFFM"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WMPro",
"vendor": "SUNNET",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"status": "affected",
"version": "5.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tony Kuo"
}
],
"datePublic": "2019-07-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via \"/teach/course/doajaxfileupload.php\". The target server can be exploited without authentication."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-11T18:22:06",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://surl.twcert.org.tw/hLFFM"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SUNNET WMPro v5.0 and v5.1 has OS Command Injection",
"x_generator": {
"engine": "Vulnogram 0.0.7"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2019-07-01T16:00:00.000Z",
"ID": "CVE-2019-11062",
"STATE": "PUBLIC",
"TITLE": "SUNNET WMPro v5.0 and v5.1 has OS Command Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "WMPro",
"version": {
"version_data": [
{
"version_value": "5.0"
},
{
"version_value": "5.1"
}
]
}
}
]
},
"vendor_name": "SUNNET"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tony Kuo"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via \"/teach/course/doajaxfileupload.php\". The target server can be exploited without authentication."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.7"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001",
"refsource": "CONFIRM",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906001"
},
{
"name": "http://surl.twcert.org.tw/hLFFM",
"refsource": "CONFIRM",
"url": "http://surl.twcert.org.tw/hLFFM"
},
{
"name": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0",
"refsource": "CONFIRM",
"url": "https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2019-11062",
"datePublished": "2019-07-11T18:22:06.876236Z",
"dateReserved": "2019-04-09T00:00:00",
"dateUpdated": "2024-09-17T00:40:32.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}