ByteOS Network

NVD Vulnerability Details :

CVE-2020-7356

Analyzed

Source-cve@rapid7.com

Published At-06 Aug, 2020 | 16:15

Updated At-12 Aug, 2020 | 13:39

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

CAYIN Technology Co.

>>xpost>>1.0

cpe:2.3:a:cayintech:xpost:1.0:*:*:*:*:*:*:*

CAYIN Technology Co.

>>xpost>>2.0

cpe:2.3:a:cayintech:xpost:2.0:*:*:*:*:*:*:*

CAYIN Technology Co.

>>xpost>>2.5.18103

cpe:2.3:a:cayintech:xpost:2.5.18103:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Primary	nvd@nist.gov
CWE-89	Secondary	cve@rapid7.com

References

Hyperlink	Source	Resource
https://github.com/rapid7/metasploit-framework/pull/13607	cve@rapid7.com	Patch Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php	cve@rapid7.com	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History