Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.
Metrics
Affected Vendors & Products
References
History
Tue, 20 Aug 2024 12:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
CPEs | cpe:2.3:a:cayintech:cms-se:-:*:*:*:*:*:*:* |
MITRE
Status: PUBLISHED
Assigner: rapid7
Published: 2020-08-06T15:45:28.433116Z
Updated: 2024-09-17T03:12:42.262Z
Reserved: 2020-01-21T00:00:00
Link: CVE-2020-7357
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-08-06T16:15:13.670
Modified: 2024-11-21T05:37:06.603
Link: CVE-2020-7357
Redhat
No data.