CVE-2020-15182

HIGH

SOY CMS < 3.0.2.328 and SOY Inquiry < 2.0.0.4 - Authenticated Remote Code Execution via CSRF

Title source: llm
STIX 2.1

Description

The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially crafted webpage. An administrator must be logged in for exploitation to be possible. This issue is fixed in SOY Inquiry version 2.0.0.4 and included in SOY CMS 3.0.2.328.

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://youtu.be/ffvKH3gwyRE
Patch, Third Party Advisory x_refsource_misc
https://github.com/inunosinsi/soycms/pull/15

Scores

CVSS v3 8.4
EPSS 0.0117
EPSS Percentile 63.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-22 CWE-352
Status published
Products (2)
soy_cms_project/soy_cms < 3.0.2.328
soy_inquiry_project/soy_inquiry < 2.0.0.4
Published Sep 17, 2020
Tracked Since Feb 18, 2026