PT-2020-17322 · Rainrocka · Rainrocka Xinhu

Published 2020-12-26 · Updated 2020-12-29 · CVE-2020-35388

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions rainrocka xinhu version 2.1.9

Description The issue allows remote attackers to obtain sensitive information via an "index.php?a=gettotal" request in which the ajaxbool value is manipulated to be true. This can lead to unauthorized access to sensitive data.

Recommendations For rainrocka xinhu version 2.1.9, consider restricting access to the "index.php?a=gettotal" endpoint until a patch is available. As a temporary workaround, avoid manipulating the ajaxbool value to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-35388

Affected Products

Rainrocka Xinhu

References · 6

• 🔥 https://github.com/xuechengen/xinhu-oa/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35388 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35388 · Vendor Advisory
• https://t.me/cvenotify/7892 · Telegram Post
• https://t.me/cvenotify/7760 · Telegram Post
• https://t.me/cibsecurity/21313 · Telegram Post