PT-2025-13690
CVE-2025-3022
·
Published
2025-03-31
·
Updated
2025-03-31
Description by
CVSS 4.0
9.3
CriticalMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
e-solutions e-management (affected versions not specified)
Description
The issue is an OS command injection vulnerability that allows an attacker to execute arbitrary commands on the server. This is achieved via the
client parameter in the "/data/apache/e-management/api/api3.php" endpoint.Recommendations
As a temporary workaround, consider restricting access to the "/data/apache/e-management/api/api3.php" endpoint to minimize the risk of exploitation.
Avoid using the
client parameter in the affected API endpoint until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability. Found an issue in the description? Have something to add? Feel free to write us 👾