Intelligent digital signage made easy. To go beyond the possibilities offered, b-swiss allows you to create the communication solution for your specific needs and your graphic charter. You benefit from our experience and know-how in the realization of your digital signage project.
The application suffers from an "authenticated" arbitrary PHP code execution. The vulnerability is caused due to the improper verification of uploaded files in 'index.php' script thru the 'rec_poza' POST parameter. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script file that will be stored in '/usr/users' directory. Due to an undocumented and hidden "maintenance" account 'admin_m' which has the highest privileges in the application, an attacker can use these hard-coded credentials to authenticate and use the vulnerable image upload functionality to execute code on the server.