Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-25257. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates authenticated command execution in LogicalDOC Enterprise by manipulating binary paths in settings. It includes multiple PoCs for RCE via antivirus, OCR, and other system commands.
Description
LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system paths to execute arbitrary system commands with elevated privileges.
Exploits (1)
This exploit demonstrates authenticated command execution in LogicalDOC Enterprise by manipulating binary paths in settings. It includes multiple PoCs for RCE via antivirus, OCR, and other system commands.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N