CVE-2020-7356

Cayin xPost SQL Injection

State: Published
Severity: 10.0 Critical
Published: Aug 6, 2020
Updated: Sep 17, 2024
Reserved: Jan 21, 2020

Description

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N	rapid7

Weaknesses

CWE-89 SQL Injection

Affected Products

Product	Versions
Cayin xPostCayin Technology	2.5.18103Affected 2.0Affected 1.0Affected

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php
https://github.com/rapid7/metasploit-framework/pull/13607

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.