by Kastro
Paper/Archive/CVE-2020-15188

CVE-2020-15188

inunosinsi soycms — Unauthenticated Remote Code Execution in SOY CMS

EPSS 5%CVSS 10.0
critical.is priorityof 100
49
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 92.3.923 × 2018.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form without any restrictions. This was fixed in 3.0.2.328.

Affected

ProductAffectedFixed inSource
soycms< 3.0.2.328–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/inunosinsi/soycms/security/advisories/GHSA-hrrx-m22r-p9jprefgithub.com/inunosinsi/soycms/issues/10refgithub.com/inunosinsi/soycms/pull/12/commits/a75642989132dd25f74a13194b27c0986c3de020refyoutube.com/watch?v=zAE4Swjc-GU&feature=youtu.be