Melis Platform vulnerabilities

File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.

A vulnerability in the melis-core module of Melis Technology's Melis Platform allows an unauthenticated attacker to create an administrator account. Exploitation occurs via a request to the '/melis/MelisCore/ToolUser/addNewUser' endpoint.

A SQL injection vulnerability in the melis-cms module of the Melis platform from Melis Technology allows an attacker to retrieve, create, update, and delete databases. The vulnerability occurs in the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.