CVE-2020-7356 : CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input p

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

Published 2020-08-06 16:15:14

Updated 2020-08-12 13:39:55

Source Rapid7, Inc.

View at NVD, CVE.org

Vulnerability category: Sql Injection

Products affected by CVE-2020-7356

Cayintech » Xpost » Version: 1.0
cpe:2.3:a:cayintech:xpost:1.0:*:*:*:*:*:*:*
Matching versions
Cayintech » Xpost » Version: 2.0
cpe:2.3:a:cayintech:xpost:2.0:*:*:*:*:*:*:*
Matching versions
Cayintech » Xpost » Version: 2.5.18103
cpe:2.3:a:cayintech:xpost:2.5.18103:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-7356

EPSS FAQ

3.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 91 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-7356

Cayin xPost wayfinder_seqid SQLi to RCE

Disclosure Date: 2020-06-04

First seen: 2020-06-18

exploit/windows/http/cayin_xpost_sql_rce

This module exploits an unauthenticated SQLi in Cayin xPost <=2.5. The wayfinder_meeting_input.jsp file's wayfinder_seqid parameter can be injected with a blind SQLi. Since this app bundles MySQL and apache Tomcat the environment is pretty static and theref

More information

CVSS scores for CVE-2020-7356

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N	3.9	5.8	cve@rapid7.con
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: None
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-7356

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Assigned by:
- cve@rapid7.con (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2020-7356

https://github.com/rapid7/metasploit-framework/pull/13607

Cayin xPost and CMS exploits by h00die · Pull Request #13607 · rapid7/metasploit-framework · GitHub
Patch;Third Party Advisory

CVEs referencing this url
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php

Zero Science Lab » Cayin Digital Signage System xPost 2.5 Pre-Auth SQLi Remote Code Execution
Exploit;Third Party Advisory

Jump to