CVE-2020-7357
CRITICALCayin CMS - Authenticated OS Command Injection via NTP_Server_IP Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-7357.
PoCs published by h00die, Gjoko Krstic (LiquidWorm) <[email protected]>, including Metasploit module exploits/linux/http/cayin_cms_ntp.
AI-analyzed exploit summary This Metasploit module exploits an authenticated RCE vulnerability in Cayin CMS <= 11.0 via command injection in the 'ntpIp' parameter of the system_service.cgi file. It uses a cmdstager to execute a reverse shell payload in chunks due to field size limitations.
Description
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.
Exploits (1)
This Metasploit module exploits an authenticated RCE vulnerability in Cayin CMS <= 11.0 via command injection in the 'ntpIp' parameter of the system_service.cgi file. It uses a cmdstager to execute a reverse shell payload in chunks due to field size limitations.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N