CVE-2020-7357: Cayin Technology Cayin CMS-SE, инжекция

Описание

Оригинално описание

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.

Засегнати продукти

• Cayin Technology Cayin CMS-SE: 11.0 Build 19179 до 11.0 Build 19179
• Cayin Technology Cayin CMS-60: 11.0 Build 19025 до 11.0 Build 19025
• Cayin Technology Cayin CMS-40: 9.0 Build 14917 до 9.0 Build 14917
• Cayin Technology Cayin CMS-20: 9.0 Build 14917 до 9.0 Build 14917
• Cayin Technology Cayin CMS: 8.2 Build 12199; 8.0 Build 11175; 7.5 Build 11175

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Други уязвимости в Cayin Technology Cayin CMS-SE

• 6.9CVE-2026-80234
• 8.6CVE-2026-80233

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2020-7357
• https://nvd.nist.gov/vuln/detail/CVE-2020-7357
• https://github.com/rapid7/metasploit-framework/pull/13607
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php
• https://exchange.xforce.ibmcloud.com/vulnerabilities/182925