CVE-2020-7356

published 2020-08-06

CVE-2020-7356: CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is…

Priority P2 73 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
cayin_technology	cayin_xpost	—	—
cayin_technology	cayin_xpost	—	—
cayin_technology	cayin_xpost	—	—
cayintech	xpost	—	—
cayintech	xpost	—	—
cayintech	xpost	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /wayfinder_meeting_input.jsp?wayfinder_seqid=↗

path wayfinder_meeting_input.jsp↗

other wayfinder_seqid↗

• → Monitor HTTP GET requests to wayfinder_meeting_input.jsp containing SQL metacharacters or injection patterns in the 'wayfinder_seqid' parameter — exploitation is unauthenticated and requires no session cookie. ↗
• → The exploit results in SYSTEM-level command execution via MySQL's bundled instance and Apache Tomcat; look for Tomcat/JSP spawning unexpected child processes (e.g., cmd.exe, powershell.exe) at SYSTEM privilege. ↗
• → Alert on reverse or bind shell payloads of type java/jsp_shell_reverse_tcp or java/jsp_shell_bind_tcp being delivered through this endpoint, as these are the only confirmed working payload types. ↗
• → The SQLi is blind; detect repeated, slightly varying GET requests to wayfinder_meeting_input.jsp in short succession (time-based or boolean-based blind SQLi enumeration pattern). ↗

• · Exploitation targets Cayin xPost versions 2.5 and below only; verify the installed version before applying detections to avoid false positives on patched deployments. ↗
• · The Metasploit module relies on static/default MySQL and Tomcat configuration bundled with xPost; detections based on default port/path assumptions may miss instances with non-default configurations. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89