Lucene search

[email protected]CVE-2020-7356

HistoryAug 06, 2020 - 4:15 p.m.

CVE-2020-7356

2020-08-0616:15:13

CWE-89

[email protected]

web.nvd.nist.gov

cve-2020-7356

cayin xpost

sql injection

wayfinder_meeting_input.jsp

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

9.9 High

AI Score

Confidence

High

0.032 Low

EPSS

Percentile

91.2%

JSON

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter ‘wayfinder_seqid’ in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

Affected configurations

NVD

Node

cayintechxpostMatch1.0

cayintechxpostMatch2.0

cayintechxpostMatch2.5.18103

CPENameOperatorVersion
cayintech:xpostcayintech xposteq1.0
cayintech:xpostcayintech xposteq2.0
cayintech:xpostcayintech xposteq2.5.18103

CPE	Name	Operator	Version
cayintech:xpost	cayintech xpost	eq	1.0
cayintech:xpost	cayintech xpost	eq	2.0
cayintech:xpost	cayintech xpost	eq	2.5.18103

CNA Affected

[
  {
    "product": "Cayin xPost",
    "vendor": "Cayin Technology",
    "versions": [
      {
        "status": "affected",
        "version": "2.5.18103"
      },
      {
        "status": "affected",
        "version": "2.0"
      },
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]