CVE-2019-8954

Name of the Vulnerable Software and Affected Versions Indexhibit version 2.1.5

Description The issue allows remote attackers to execute arbitrary code. This can be achieved by exploiting the v parameter in conjunction with the id parameter when a upd jxcode=true action is sent to the "ndxzstudio/?a=system" URI.

Recommendations For Indexhibit version 2.1.5, consider disabling access to the "ndxzstudio/?a=system" URI or restricting the use of the v and id parameters in this context until a patch is available. Avoid using the v parameter in conjunction with the id parameter for the upd jxcode=true action to minimize the risk of exploitation.