Exploit for Code Injection in Vinchin Vinchin_Backup_And_Recovery

🗓️ 06 Nov 2023 09:24:15Reported by ChocapikkType

A full exploit chain for Authenticated Remote Code Execution (RCE) on VinChin version 7.2 and earlier, addressing vulnerabilities CVE-2024-22899 through CVE-2024-22903

Reporter	Title	Published	Views	Family All 53
0day.today	Vinchin Backup And Recovery 7.2 syncNtpTime Command Injection Vulnerability	29 Jan 202400:00	–	zdt
0day.today	Vinchin Backup And Recovery 7.2 Default Root Credentials Vulnerability	29 Jan 202400:00	–	zdt
0day.today	Vinchin Backup And Recovery 7.2 SystemHandler.class.php Command Injection Vulnerability	29 Jan 202400:00	–	zdt
BDU FSTEC	The vulnerability of the Vinchin Backup & Recovery software for backup and restoration operations, related to the use of pre-installed user accounts, allows a hacker to elevate their privileges to the level of a root user.	6 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the deleteUpdateAPK() function in the Vinchin Backup & Recovery software allows a hacker to execute arbitrary commands.	9 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the syncNtpTime() function in the SystemHandler.class.php script of the software for backup and recovery, Vinchin Backup & Recovery, allows a perpetrator to execute arbitrary commands.	9 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Vinchin Backup & Recovery software for backup and restoration operations, related to the use of default user accounts, allows a perpetrator to escalate their privileges.	15 Feb 202400:00	–	bdu_fstec
Circl	CVE-2024-22899	2 Feb 202403:22	–	circl
Circl	CVE-2024-22901	2 Feb 202403:22	–	circl
Circl	CVE-2024-22902	2 Feb 202403:22	–	circl

06 Apr 2025 16:52Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.02369

SSVC