Vulnerability-Lookup

CNVD-2017-09892

Vulnerability from cnvd - Published: 2017-06-16

Title

多个eMLi 产品目录遍历漏洞

Description

AuroMeera Technometrix Pvt eMLi School Management等都是印度AuroMeera公司的应用于教育行业的产品。eMLi School Management是一套学校管理系统；eMLi College Campus Management是一套校园综合管理系统。多个eMLi 产品存在目录遍历漏洞，由于程序未能充分验证用户输入。远程攻击者可以使用特制的目录遍历序列（'../'）检索敏感信息。

Severity

中

Formal description

目前没有详细的解决方案提供： http://www.auromeera.com/

Reference

http://www.securityfocus.com/bid/97255 https://nvd.nist.gov/vuln/detail/CVE-2017-7258

Impacted products

Name
AuroMeera Technometrix Pvt. Ltd eMLi University Management 1.0

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97255"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-7258",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7258"
    }
  },
  "description": "AuroMeera Technometrix Pvt eMLi School Management\u7b49\u90fd\u662f\u5370\u5ea6AuroMeera\u516c\u53f8\u7684\u5e94\u7528\u4e8e\u6559\u80b2\u884c\u4e1a\u7684\u4ea7\u54c1\u3002eMLi School Management\u662f\u4e00\u5957\u5b66\u6821\u7ba1\u7406\u7cfb\u7edf\uff1beMLi College Campus Management\u662f\u4e00\u5957\u6821\u56ed\u7efc\u5408\u7ba1\u7406\u7cfb\u7edf\u3002\r\n\r\n\u591a\u4e2aeMLi \u4ea7\u54c1\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u9a8c\u8bc1\u7528\u6237\u8f93\u5165\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u4f7f\u7528\u7279\u5236\u7684\u76ee\u5f55\u904d\u5386\u5e8f\u5217\uff08\u0027../\u0027\uff09\u68c0\u7d22\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "unqdrms",
  "formalWay": "\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u89e3\u51b3\u65b9\u6848\u63d0\u4f9b\uff1a\r\nhttp://www.auromeera.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-09892",
  "openTime": "2017-06-16",
  "products": {
    "product": "AuroMeera Technometrix Pvt. Ltd eMLi University Management 1.0"
  },
  "referenceLink": "http://www.securityfocus.com/bid/97255\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-7258",
  "serverity": "\u4e2d",
  "submitTime": "2017-05-24",
  "title": "\u591a\u4e2aeMLi \u4ea7\u54c1\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}

CVE-2017-7258 (GCVE-0-2017-7258)

Vulnerability from cvelistv5 – Published: 2017-03-29 20:00 – Updated: 2024-08-05 15:56

Summary

HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerful commands on the web server which can lead to a full compromise of the system via Directory Path Traversal, as demonstrated by reading core-emli/Storage. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

2 references

URL	Tags
https://sudoat.blogspot.in/2017/03/path-traversal…	x_refsource_MISC
http://www.securityfocus.com/bid/97255	vdb-entryx_refsource_BID

Date Public

2017-03-29 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:56:36.399Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html"
          },
          {
            "name": "97255",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97255"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-03-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerful commands on the web server which can lead to a full compromise of the system via Directory Path Traversal, as demonstrated by reading core-emli/Storage. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-03T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html"
        },
        {
          "name": "97255",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97255"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-7258",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerful commands on the web server which can lead to a full compromise of the system via Directory Path Traversal, as demonstrated by reading core-emli/Storage. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html",
              "refsource": "MISC",
              "url": "https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html"
            },
            {
              "name": "97255",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97255"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-7258",
    "datePublished": "2017-03-29T20:00:00.000Z",
    "dateReserved": "2017-03-24T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:56:36.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-09892

CVE-2017-7258 (GCVE-0-2017-7258)

Tags

Sightings

Nomenclature