CVE-2020-37186 - Vulnerability Analysis

Overview

Chevereto 3.13.4 Core contains a remote code execution caused by manipulation of the database table prefix parameter during database configuration installation, letting attackers execute arbitrary system commands remotely, exploit requires crafted POST request.

Severity & Score

Impact

Attackers can execute arbitrary system commands remotely, potentially leading to full server compromise.

Mitigation

Update to the latest version.

References

• https://chevereto.com/
• https://github.com/Chevereto/Chevereto-Free/releases
• https://www.exploit-db.com/exploits/47903
• https://www.vulncheck.com/advisories/chevereto-core-remote-code-execution

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner