CVE-2020-7356 in xPost

摘要

由 MITRE

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• 负责: Rapid7, Inc.
• 预定: 2020-01-21
• 管理: 已接受
• 条目: VDB-159363
• CPE: 准备好
• CWE: CWE-89 (已确认)
• 利用: 下载
• CVSS: 10.0 (NVD)
• EPSS: 0.14014
• KEV: 否
• 活动: 非常低

来源

• MITRE: https://www.cve.org/CVERecord?id=CVE-2020-7356
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-7356
• CVE Details: https://www.cvedetails.com/cve/CVE-2020-7356/