Home

Description

ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.

PUBLISHED Reserved 2025-12-05 | Published 2025-12-05 | Updated 2025-12-05 | Assigner VulnCheck




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unknown

7.0.3.4968
affected

Default status
unknown

7.0.2.4954
affected

6.5.2.4954
affected

6.4.2.4681
affected

6.3.2.4203
affected

2.0.1.823
affected

Credits

LiquidWorm, Gjoko 'LiquidWorm' Krstic, Macedonian Information Security Research and Development Laboratory, Zero Science Lab - https://www.zeroscience.mk - @zeroscience finder

References

www.exploit-db.com/exploits/48952 (Exploit Database Entry 48952) exploit

www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5602.php (Vendor Security Advisory for ZSL-2020-5602) vendor-advisory

request.com/ (Official Product Homepage) product

www.vulncheck.com/...play-f-media-server-unauthenticated-rce third-party-advisory

cve.org (CVE-2020-36877)

nvd.nist.gov (CVE-2020-36877)