Cordaware Bestinformed Web Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Cordaware Bestinformed Web application, specifically in version 6.4.0.4. This issue allows authenticated users with the right permissions to execute commands on the server hosting the application. By default, only admin users can create 'ScriptVars' of the type 'script' and preview them. However, these permissions can be granted to other users through a granular permission system. An attacker could exploit this vulnerability if they compromised an account with the necessary rights.

Impact

Exploitation of this vulnerability allows for remote code execution on the server running the Bestinformed Web application.

Remediation

Users can update to Cordaware Bestinformed Web Interface version 6.2.2.5 to address this vulnerability.