vendor:
Cayin Content Management Server
by:
LiquidWorm
7.5
CVSS
HIGH
Remote Command Injection
78
CWE
Product Name: Cayin Content Management Server
Affected Version From: CMS-SE v11.0 Build 19179
Affected Version To: CMS v7.5 Build 11175
Patch Exists: NO
Related CWE: N/A
CPE: a:cayin_technology:cayin_content_management_server
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Apache/1.3.42 (Unix)
2020
Cayin Content Management Server 11.0 – Remote Command Injection (root)
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page.
Mitigation:
Ensure that the application is not vulnerable to command injection attacks by validating all user input and sanitizing it before passing it to the system.