Cross-site Request Forgery leading to RCE in SOY CMS
Priority MEDIUM 44CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially crafted webpage. An administrator must be logged in for exploitation to be possible. This issue is fixed in SOY Inquiry version 2.0.0.4 and included in SOY CMS 3.0.2.328.
Why it matters now
EPSS 0.01171 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed soycms (inunosinsi): 2.0.0.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| inunosinsi | soycms | before 2.0.0.4 | 2.0.0.4 | Patch available | CNA |
- soycms Vendorinunosinsi Affected before 2.0.0.4 Fixed in 2.0.0.4 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:soy_cms_project:soy_cms:*:*:*:*:*:*:*:* | before 3.0.2.328 | Vulnerable | Soy Cms Project |
| cpe:2.3:a:soy_inquiry_project:soy_inquiry:*:*:*:*:*:*:*:* | before 2.0.0.4 | Vulnerable | Soy Inquiry Project |
- cpe:2.3:a:soy_cms_project:soy_cms:*:*:*:*:*:*:*:* Versions before 3.0.2.328 Vulnerable ·Soy Cms Project
- cpe:2.3:a:soy_inquiry_project:soy_inquiry:*:*:*:*:*:*:*:* Versions before 2.0.0.4 Vulnerable ·Soy Inquiry Project
Remediation
- Fix · CNA soycms (inunosinsi) Fixed in 2.0.0.4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15182
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences