QiHang Media Web Digital Signage Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in QiHang Media Web Digital Signage version 3.0.9. This vulnerability allows unauthenticated attackers to upload malicious ASPX scripts via the QH.aspx file. Exploitation involves using the 'remotePath' and 'fileToUpload' parameters to traverse directories, write files, and execute arbitrary system commands on the server.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server.

Reproduction

To reproduce this vulnerability, upload a malicious ASPX file using the 'fileToUpload' parameter through the QH.aspx file upload functionality. Include a payload that executes system commands, such as a script that runs commands via the Windows command line. The 'remotePath' parameter can be used to specify the directory where the file should be uploaded.