CVE-2020-7356 in the critical feed json
Cayin xPost SQL Injection
published 2020-08-06 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-28483
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.0%
- EPSS 14.0% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Metasploit
Summary
CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.
Patch / fix
- github.com/rapid7/metasploit-framework#13607 pull request
Timeline
- First public exploit (Metasploit exploit/windows/http/cayin_xpost_sql_rce)
- Published
Exploit prediction
14.01% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/windows/http/cayin_xpost_sql_rce Cayin xPost wayfinder_seqid SQLi to RCE metasploit exploit, excellent rank, 2020-06-04
- zeroscience.mk https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Cayin Technology Cayin xPost
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/rapid7/metasploit-framework/pull/13607
patch, third-party-advisory
-
zeroscience.mk
/en/vulnerabilities/ZSL-2020-5571.php
exploit, third-party-advisory
Sources
- CVE List CVE-2020-7356
- NVD CVE-2020-7356
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.