Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2020-7356

Cayin xPost SQL Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cayin Technology Cayin xPost

  • 2.5.18103affected
  • 2.0affected
  • 1.0affected

References