CVE-2020-24985

Name of the Vulnerable Software and Affected Versions: Quadbase EspressReports ES version 7 Update 9

Description: An issue allows an authenticated user to navigate to the MenuPage section of the application and change the frmsrc parameter value. This enables the retrieval and execution of external files or payloads.

Recommendations: For Quadbase EspressReports ES version 7 Update 9, consider restricting access to the MenuPage section to prevent unauthorized changes to the frmsrc parameter. As a temporary workaround, avoid using the frmsrc parameter in the affected application until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.