Vulnerability-Lookup

CNVD-2017-09892

Vulnerability from cnvd - Published: 2017-06-16

Title

多个eMLi 产品目录遍历漏洞

Description

AuroMeera Technometrix Pvt eMLi School Management等都是印度AuroMeera公司的应用于教育行业的产品。eMLi School Management是一套学校管理系统；eMLi College Campus Management是一套校园综合管理系统。多个eMLi 产品存在目录遍历漏洞，由于程序未能充分验证用户输入。远程攻击者可以使用特制的目录遍历序列（'../'）检索敏感信息。

Severity

中

Formal description

目前没有详细的解决方案提供： http://www.auromeera.com/

Reference

http://www.securityfocus.com/bid/97255 https://nvd.nist.gov/vuln/detail/CVE-2017-7258

Impacted products

Name
AuroMeera Technometrix Pvt. Ltd eMLi University Management 1.0

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97255"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-7258",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7258"
    }
  },
  "description": "AuroMeera Technometrix Pvt eMLi School Management\u7b49\u90fd\u662f\u5370\u5ea6AuroMeera\u516c\u53f8\u7684\u5e94\u7528\u4e8e\u6559\u80b2\u884c\u4e1a\u7684\u4ea7\u54c1\u3002eMLi School Management\u662f\u4e00\u5957\u5b66\u6821\u7ba1\u7406\u7cfb\u7edf\uff1beMLi College Campus Management\u662f\u4e00\u5957\u6821\u56ed\u7efc\u5408\u7ba1\u7406\u7cfb\u7edf\u3002\r\n\r\n\u591a\u4e2aeMLi \u4ea7\u54c1\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u9a8c\u8bc1\u7528\u6237\u8f93\u5165\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u4f7f\u7528\u7279\u5236\u7684\u76ee\u5f55\u904d\u5386\u5e8f\u5217\uff08\u0027../\u0027\uff09\u68c0\u7d22\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "unqdrms",
  "formalWay": "\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u89e3\u51b3\u65b9\u6848\u63d0\u4f9b\uff1a\r\nhttp://www.auromeera.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-09892",
  "openTime": "2017-06-16",
  "products": {
    "product": "AuroMeera Technometrix Pvt. Ltd eMLi University Management 1.0"
  },
  "referenceLink": "http://www.securityfocus.com/bid/97255\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-7258",
  "serverity": "\u4e2d",
  "submitTime": "2017-05-24",
  "title": "\u591a\u4e2aeMLi \u4ea7\u54c1\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}

CVE-2017-7258 (GCVE-0-2017-7258)

Vulnerability from cvelistv5 – Published: 2017-03-29 20:00 – Updated: 2024-08-05 15:56

Summary

HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerful commands on the web server which can lead to a full compromise of the system via Directory Path Traversal, as demonstrated by reading core-emli/Storage. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2286 records in the last 180 days details

References

2 references

URL	Tags
https://sudoat.blogspot.in/2017/03/path-traversal…	x_refsource_MISC
http://www.securityfocus.com/bid/97255	vdb-entryx_refsource_BID

Date Public

2017-03-29 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:56:36.399Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html"
          },
          {
            "name": "97255",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97255"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-03-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerful commands on the web server which can lead to a full compromise of the system via Directory Path Traversal, as demonstrated by reading core-emli/Storage. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-03T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html"
        },
        {
          "name": "97255",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97255"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-7258",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerful commands on the web server which can lead to a full compromise of the system via Directory Path Traversal, as demonstrated by reading core-emli/Storage. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html",
              "refsource": "MISC",
              "url": "https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html"
            },
            {
              "name": "97255",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97255"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-7258",
    "datePublished": "2017-03-29T20:00:00.000Z",
    "dateReserved": "2017-03-24T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:56:36.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted