PT-2020-14259 · Soy · Soy Cms

Published 2020-09-18 · Updated 2020-09-29 · CVE-2020-15188

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOY CMS versions 3.0.2.327 and earlier

Description The issue allows remote attackers to execute arbitrary code when the inquiry form feature is enabled. This is caused by unserializing the form without restrictions.

Recommendations For versions 3.0.2.327 and earlier, update to version 3.0.2.328 to resolve the issue. As a temporary workaround, consider disabling the inquiry form feature until the update is applied.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-15188

GHSA-HRRX-M22R-P9JP

Affected Products

Soy Cms

References · 6

• 🔥 https://github.com/inunosinsi/soycms/issues/10 · Exploit
• 🔥 https://github.com/inunosinsi/soycms/security/advisories/GHSA-hrrx-m22r-p9jp · Exploit
• 🔥 https://youtube.com/watch?v=zAE4Swjc-GU&feature=youtu.be · Exploit
• https://github.com/inunosinsi/soycms/pull/12/commits/a75642989132dd25f74a13194b27c0986c3de020 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15188 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15188 · Vendor Advisory