M2Soft CROWNIX Report & ERS Arbitrary File Upload Vulnerability in Opcode 500 Functionality
Vulnerability
An arbitrary file upload vulnerability has been identified in M2Soft CROWNIX Report & ERS versions 5.x prior to 5.5.14.1070, 7.x prior to 7.4.3.960, and 8.x prior to 8.2.0.345. This vulnerability allows attackers to execute arbitrary code by uploading a crafted file through the opcode 500 functionality.
Impact
Exploitation of this vulnerability allows for arbitrary code execution on the server where CROWNIX Report & ERS is running.
Reproduction
To reproduce this vulnerability, upload a malicious file through the CROWNIX ERS Reporting Server's opcode 500 feature. The uploaded file can then be executed on the server.
Remediation
Users are advised to update to CROWNIX Report & ERS version 5.5.14.1071, 7.4.3.961, or 8.2.0.346. Instructions for obtaining the patch are available by contacting the M2Soft technical support center.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.