CVE-2020-36898
Published: 10 December 2025
Description
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to…
more
delete arbitrary files with web server permissions using directory traversal sequences.
Mitigating Controls (NIST 800-53 r5)AI
Validates the 'data' parameter in POST requests to QH.aspx to prevent directory traversal sequences from enabling arbitrary file deletion.
Enforces authentication and authorization requirements before permitting file deletion operations at the QH.aspx endpoint.
Limits web server process privileges to prevent deletion of critical files even if directory traversal succeeds.
Security SummaryAI
CVE-2020-36898 is an unauthenticated arbitrary file deletion vulnerability in QiHang Media Web Digital Signage version 3.0.9. The flaw resides in the QH.aspx endpoint, where remote attackers can exploit the 'data' parameter via a POST request containing directory traversal sequences to delete arbitrary files using the web server's permissions.
Any remote attacker can exploit this vulnerability without authentication (PR:N). Successful exploitation enables deletion of critical files, resulting in high integrity (I:H) and availability (A:H) impacts but no confidentiality loss (C:N), as reflected in its CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U). The issue stems from CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Advisories from VulnCheck (https://www.vulncheck.com/advisories/qihang-media-web-digital-signage-unauthenticated-arbitrary-file-deletion), Zero Science Labs (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php), and an Exploit-DB proof-of-concept (https://www.exploit-db.com/exploits/48749) provide additional technical details. Security practitioners should review these sources for recommended mitigations.
A public exploit is available on Exploit-DB, indicating practical exploitability despite the CVE's publication on 2025-12-10.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of public-facing web application via directory traversal (T1190) enables arbitrary file deletion for disruption and data destruction (T1107).