QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.
Secably automatically detects the issues discussed in this article.
A small VPS is enough to run and test these services safely.
Contabo →
Cheap VPS & dedicated servers, EU/US/Asia
Vultr →
Cloud VPS in 30+ locations, hourly billing
UltaHost →
NVMe VPS with DDoS protection
Cherry Servers →
Bare metal & cloud servers
Affiliate links: we may earn a commission, your price stays the same.
