CVE-2020-36897
CriticalSummary
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.
Risk Assessment
The risk to the organization is full server takeover by an unauthenticated attacker, potentially leading to compromise of confidentiality, integrity, and availability.
Recommendation
It is recommended to immediately update the software to the latest version and restrict access to the admin panel and file upload functionality.
Original NVD description (English source)
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.