CVE-2020-19305
📋 TL;DR
This vulnerability in Metinfo CMS allows attackers to escalate privileges by exploiting improper path handling when deleting columns. Attackers can delete the indeximg parameter, potentially gaining administrative access. All Metinfo v7.0.0 installations are affected.
💻 Affected Systems
- Metinfo CMS
📦 What is this software?
Metinfo by Metinfo
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative access, allowing data theft, defacement, or installation of backdoors.
Likely Case
Unauthorized administrative access leading to content manipulation, user data exposure, or further exploitation.
If Mitigated
Limited impact with proper access controls and monitoring, potentially only affecting non-critical functions.
🎯 Exploit Status
Exploitation requires some level of access but is straightforward once initial access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v7.0.1 or later
Vendor Advisory: https://www.metinfo.cn/
Restart Required: No
Instructions:
1. Backup your Metinfo installation and database. 2. Download the latest version from the official Metinfo website. 3. Replace the vulnerable file /app/system/column/admin/index.class.php with the patched version. 4. Verify the fix by checking that the indeximg parameter handling is properly validated.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit access to the admin interface using IP whitelisting or network segmentation.
# Example: Apache .htaccess
Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
File Permission Hardening
linuxSet strict permissions on the vulnerable file to prevent unauthorized modifications.
chmod 644 /app/system/column/admin/index.class.php
chown root:www-data /app/system/column/admin/index.class.php
🧯 If You Can't Patch
- Implement strict access controls and monitor admin interface activity for suspicious behavior.
- Deploy a web application firewall (WAF) with rules to detect and block privilege escalation attempts.
🔍 How to Verify
Check if Vulnerable:
Check if your Metinfo version is 7.0.0 by reviewing the version file or admin panel.Check Version:
grep -r 'version' /path/to/metinfo/ or check admin panel → System → Basic InformationVerify Fix Applied:
Verify the file /app/system/column/admin/index.class.php has been updated to a version that includes proper input validation for the indeximg parameter.📡 Detection & Monitoring
Log Indicators:
- Unusual admin login attempts
- Multiple failed column deletion requests
- Unexpected modifications to indeximg parameter
Network Indicators:
- HTTP POST requests to /app/system/column/admin/index.class.php with suspicious parameters
SIEM Query:
source="web_logs" AND uri="/app/system/column/admin/index.class.php" AND (method="POST" OR params="indeximg")