Description
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cayin Technology | Cayin CMS-SE | 11.0 Build 19179 – ≤ 11.0 Build 19179 | — |
| Cayin Technology | Cayin CMS-60 | 11.0 Build 19025 – ≤ 11.0 Build 19025 | — |
| Cayin Technology | Cayin CMS-40 | 9.0 Build 14917 – ≤ 9.0 Build 14917 | — |
| Cayin Technology | Cayin CMS-20 | 9.0 Build 14917 – ≤ 9.0 Build 14917 | — |
| Cayin Technology | Cayin CMS | 8.2 Build 12199, 8.0 Build 11175, 7.5 Build 11175 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Cayin CMS NTP Server RCE
exploit/linux/http/cayin_cms_ntp
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.