CVE-2020-15921

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/159239/Mida-eFramework-2.9.0-Backdoor-Access.htmlExploit, Third Party Advisory, VDB Entry
https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.htmlExploit, Third Party Advisory
http://packetstormsecurity.com/files/159239/Mida-eFramework-2.9.0-Backdoor-Access.htmlExploit, Third Party Advisory, VDB Entry
https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.htmlExploit, Third Party Advisory

Timeline

Published: Jul 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-159229.8There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative CVE-2020-159237.5Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.CVE-2020-159247.5There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection CVE-2020-159258.8A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.10.21 allows remote authenticated attackers to execute arbitrary CVE-2020-159266.1Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the clien CVE-2020-159278.8Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP mo CVE-2020-159285.3In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters to test-browser/index.cfm allow directory traversal.CVE-2020-159299.8In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write CVE-2020-15937.6<p>A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully ex CVE-2020-159306.1An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.CVE-2020-159317.5Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain CVE-2020-159328.8Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges.