CVE-2019-11062

The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.

Score

CVSS 3.1 9.8 Critical

Status

Modified - twcert@cert.org.tw

Published

2019-07-11

Last modified

2024-09-17

Weaknesses

CWE-78

Affected products

• Wmpro (Sun.net)
• Wmpro (Sunnet)

References

• http://surl.twcert.org.tw/hLFFM
• https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0
• https://tvn.twcert.org.tw/taiwanvn/TVN-201906001