← Advisories

Cayin Digital Signage System xPost 2.5 Pre-Auth SQLi Remote Code Execution

Critical
Advisory ID
ZSL-2020-5571
Release Date
04 June 2020
Vendor
CAYIN Technology Co., Ltd. - https://www.cayintech.com
Affected Version
2.5.18103, 2.0, 1.0
Tested On
Microsoft Windows 10 Home, Microsoft Windows 8.1, Microsoft Windows Server 2016, Microsoft Windows Server 2012, Microsoft Windows 7 Ultimate SP1, Apache Tomcat/9.0.1, MySQL/5.0
Summary

CAYIN xPost is the web-based application software, which offers a combination of essential tools to create rich contents for digital signage in different vertical markets. It provides an easy-to-use platform for instant data entry and further extends the usage of CAYIN SMP players to meet users' requirements of frequent, daily maintenance.

Description

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

Proof of Concept
Disclosure Timeline
15.05.2020Vulnerability discovered.
23.05.2020Vendor contacted.
25.05.2020Vendor responds asking more details.
25.05.2020Sent details to the vendor.
04.06.2020No response from the vendor.
04.06.2020Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
04.06.2020Initial release
05.06.2020Added reference [1], [2], [3] and [4]
22.06.2020Added reference [5], [6], [7], [8], [9] and [10]
03.07.2020Added reference [11]