Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| https://github.com/rapid7/metasploit-framework/pull/13607 | patch exploit |
| https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php | third party advisory exploit |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/182925 | vendor advisory third party advisory vdb entry |