High · published December 10, 2025
🚨 An unauthenticated file deletion vulnerability is hiding in QiHang Media Web Digital Signage 3.0.9! Anyone can delete files without even logging in – talk about having an open back door! ⚡ Think of it as a delivery person who can just toss out anyone's packages without needing a signature — they don’t even have to check if the contents are yours! This vulnerability allows attackers to specify which files to delete with nothing holding them accountable. Imagine an attacker swooping in and wiping out crucial files on your server, leading to potential downtime or loss of important data. They could delete anything within reach, wreaking absolute havoc on your digital signage system!
Think of it as a delivery person who can just toss out anyone's packages without needing a signature — they don’t even have to check if the contents are yours! This vulnerability allows attackers to specify which files to delete with nothing holding them accountable. This vulnerability exists in the QH.aspx endpoint, where attackers can manipulate the 'data' parameter to send a POST request with directory traversal sequences, thereby deleting arbitrary files without authentication.
Imagine an attacker swooping in and wiping out crucial files on your server, leading to potential downtime or loss of important data. They could delete anything within reach, wreaking absolute havoc on your digital signage system! To tackle this, immediately update your QiHang Media Web Digital Signage to the latest version! Additionally, implement strict access controls and validate the 'data' parameter to ensure only authorized users can perform file deletions. You've got this! Follow these steps to secure your system and keep those digital signs shining bright! 🛡️