CVE-2024-7728

The specific CGI of the CAYIN Technology CMS does not properly validate user input, allowing a remote attacker with administrator privileges to inject OS commands into the specific parameter and execute them on the remote server.

Score

CVSS 3.1 7.2 High

Status

Deferred - twcert@cert.org.tw

Published

2024-08-14

Last modified

2024-08-14

Weaknesses

CWE-78

Affected products

• Cms-se (Cayin Technology)
• Cms-se18.04 (Cayin Technology)
• Cms-se22.04 (Cayin Technology)
• Cms-se (Cayintech)
• Cms-se(18.04) (Cayintech)
• Cms-se(22.04) (Cayintech)

References

• https://resource1.cayintech.com/patch/
• https://www.twcert.org.tw/en/cp-139-8002-b6167-2.html
• https://www.twcert.org.tw/tw/cp-132-8001-8416d-1.html