CVE-2020-15188

Unauthenticated Remote Code Execution in SOY CMS

State: Published
Severity: 10.0 Critical
Published: Sep 18, 2020
Updated: Aug 4, 2024
Reserved: Jun 25, 2020

Description

SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form without any restrictions. This was fixed in 3.0.2.328.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-502 {"CWE-502":"Deserialization of Untrusted Data"}

Affected Products

Product	Versions
soycmsinunosinsi	< 3.0.2.328Affected

References

https://github.com/inunosinsi/soycms/security/advisories/GHSA-hrrx-m22r-p9jp
https://github.com/inunosinsi/soycms/issues/10
https://github.com/inunosinsi/soycms/pull/12/commits/a75642989132dd25f74a13194b27c0986c3de020
https://www.youtube.com/watch?v=zAE4Swjc-GU&feature=youtu.be

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.