Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-5726. PoCs published by Jacob Baines.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Grandstream UCM6200 Series CTI Interface, allowing an attacker to disclose user passwords by brute-forcing character by character. It leverages blind SQL injection to extract password length and content.
Description
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in Grandstream UCM6200 Series CTI Interface, allowing an attacker to disclose user passwords by brute-forcing character by character. It leverages blind SQL injection to extract password length and content.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N