CVE-2020-5722
CRITICAL KEV NUCLEIGrandstream UCM6200 <1.0.19.20 - SQL Injection
Title source: llmExploitation Summary
CVE-2020-5722 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 28, 2022.
EIP tracks 2 public exploits from researchers including Jacob Baines, jbaines-r7, including a Metasploit module exploits/linux/http/grandstream_ucm62xx_sendemail_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets CVE-2020-5722, a remote command injection vulnerability in Grandstream UCM6202 devices. It leverages the `sendPasswordEmail` action in the CGI interface to inject a reverse shell payload via the `user_name` parameter.
Description
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
Exploits (2)
This exploit targets CVE-2020-5722, a remote command injection vulnerability in Grandstream UCM6202 devices. It leverages the `sendPasswordEmail` action in the CGI interface to inject a reverse shell payload via the `user_name` parameter.
This Metasploit module exploits an unauthenticated SQL injection (CVE-2020-5722) and command injection vulnerability in Grandstream UCM62xx IP PBX devices, allowing remote code execution as root. The exploit leverages the 'Forgot Password' feature to inject malicious commands via a Python script executed by the shell.
Nuclei Templates (1)
ssl:"Grandstream" "Set-Cookie: TRACKID"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H