Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.
References
Link | Resource |
---|---|
https://exchange.xforce.ibmcloud.com/vulnerabilities/182925 | Third Party Advisory VDB Entry |
https://github.com/rapid7/metasploit-framework/pull/13607 | Exploit Patch |
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: rapid7
Published: 2020-04-06T00:00:00
Updated: 2020-08-06T15:45:28
Reserved: 2020-01-21T00:00:00
Link: CVE-2020-7357
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-08-06T16:15:13.670
Modified: 2023-07-27T13:31:55.497
Link: CVE-2020-7357
JSON object: View
Redhat Information
No data.
CWE