### [CVE-2020-7357](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7357)
![](https://img.shields.io/static/v1?label=Product&message=Cayin%20CMS&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Cayin%20CMS-20&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Cayin%20CMS-40&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Cayin%20CMS-60&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Cayin%20CMS-SE&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=11.0%20Build%2019025%3C%3D%2011.0%20Build%2019025%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=11.0%20Build%2019179%3C%3D%2011.0%20Build%2019179%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=8.2%20Build%2012199%3D%208.2%20Build%2012199%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.0%20Build%2014917%3C%3D%209.0%20Build%2014917%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%20OS%20Command%20Injection&color=brighgreen)

### Description

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.

### POC

#### Reference
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php

#### Github
- https://github.com/ARPSyndicate/cvemon