CVE-2020-25557: In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. After that, when attacker logs in to the…

PriorityP267high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

9.85%

95.0th percentile

In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. After that, when attacker logs in to the application, attacker's code will be run. As a result of this vulnerability, authenticated user can run command on the server.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
cmsuno_project	cmsuno	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/uno.php↗

url/uno/central.php↗

commandaction=sauvePass&unox=<token>&user0=<user>&pass0=<pass>&user=<payload>&pass=<pass>&lang=en↗

commandpayload = "<user>";$pass='<pass>';system('<cmd}');?>// "↗

path/uno/central.php↗

path/uno/config.php↗

path/uno.php↗

→Monitor POST requests to /uno/central.php containing the parameter 'action=sauvePass' with a 'user' or 'lang' field containing PHP code patterns such as system(), ?>// , or semicolon-delimited PHP injection sequences. ↗
→Detect POST requests to /uno/central.php that include the header 'X-Requested-With: XMLHttpRequest' combined with 'action=sauvePass', which is the specific trigger for the vulnerable code path. ↗
→Alert on login attempts to /uno.php followed immediately by a POST to /uno/central.php with action=sauvePass — this two-step sequence (login then exploit, then re-login to trigger payload) is characteristic of this exploit chain. ↗
→The injected PHP payload is stored in the username field and executed upon next login; look for PHP code fragments (e.g., system(), ?>//) persisted in CMSUno user/config files such as uno/password.php. ↗
→Use the Google Dork 'inurl:uno.php intitle:"CMSUno - Login"' to identify exposed CMSUno 1.6.2 instances that may be targeted. ↗

·The exploit requires prior authentication; the attacker must have valid credentials to CMSUno before injecting the PHP payload via the username change functionality. ↗
·Two exploitation techniques exist: 'user' param (CVE-2020-25557, returns command output) and 'lang' param (CVE-2020-25538, blind RCE with no output). Detection rules should cover both POST parameter patterns. ↗
·Affected versions are 1.6.1 and 1.6.2; the exploit was tested on a Docker image running php:7.4-apache (Debian buster). ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.