Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Enterprise_content_management | Dokmee | 7.4.6 (including) | 7.4.6 (including) |