CVE-2019-7254

This exploit demonstrates an unauthenticated directory traversal vulnerability in eMerge E3 1.00-06, allowing an attacker to read arbitrary files (e.g., /etc/passwd) via path traversal sequences in HTTP GET requests.

This exploit demonstrates a privilege escalation vulnerability in eMerge E3 1.00-06 by sending a crafted POST request to update a user's role to administrator (UserRole=1). It also includes a disclosure request to list users, confirming the escalation.