Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MetInfo CMS",
          "vendor": "Metinfo Cms",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "---------------------------------------------------------------------------\nMetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability\n---------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.metinfo.cn\n\n\n[-] Affected Versions:\n\nVersions 7.9, 8.0, and 8.1.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located into the\n/app/system/weixin/include/class/weixinreply.class.php script.\n\nSpecifically, within the weixinreply::wxAdminLogin() method:\n\n149.     public function wxAdminLogin($data = array(),$code = \u0027\u0027)\n150.     {\n151.         global $_M;\n152.         $weixinapi = load::mod_class(\u0027weixin/weixinapi\u0027,\u0027new\u0027);\n153.         $login_code = cache::get(\"weixin/\".$code);\n154.          if ($login_code) {\n155.             cache::put(\"weixin/\".$login_code,$data[\u0027FromUserName\u0027]);\n156.          }\n157.         return;\n158.     }\n\nUser input passed through the \"EventKey\" and \"FromUserName\" XML tags\nfrom the HTTP request body when dispatching weixin API requests is not\nproperly sanitized before being used in a call to the cache::get() and\ncache::put() methods respectively.\n\nSpecifically, the $code parameter may include Path Traversal\nsequences, making the cache::get() method into including arbitrary PHP\nfiles. This can be abused to set the $login_code variable to the\n\"Array\" string by including an arbitrary cache file. Subsequently, the\ncache::put() method will write the \"FromUserName\" parameter into the\n/cache/weixin/Array.php file, embedding it within double quotes:\n\n30.     public static function put($file, $data, $type = \u0027php\u0027)\n31.     {\n32.         global $_M;\n33.\n34.         load::sys_func(\u0027file\u0027);\n35.         $save = PATH_CACHE . $file . \u0027.\u0027 . $type;\n36.         makefile($save);\n37.         #$data = str_replace(array(\"\\\"\", \"\\\\\"), array(\"\\\\\\\"\",\n\"\\\\\\\\\"), $data);\n38.         if (!is_array($data)) {\n39.             file_put_contents($save, \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or\nexit(\u0027No permission\u0027);\\n\\$cache=\\\"{$data}\\\";\\n?\u003e\");\n40.         } else {\n41.             $info = var_export($data, true);\n42.             $info = \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or exit(\u0027No\npermission\u0027);\\n\\$cache = {$info};\\n?\u003e\";\n43.             file_put_contents($save, $info);\n44.         }\n45.     }\n\nThis can be exploited by remote, unauthenticated attackers to inject\nand execute arbitrary PHP code by abusing PHP\u0027s complex curly syntax,\nleading to unauthenticated Remote Code Execution (RCE).\n\nNOTE: when MetInfo is running on non-Windows servers, successful\nexploitation of this vulnerability requires the /cache/weixin/\ndirectory to exist, which is created when installing and configuring\nthe official WeChat plugin.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-29014.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[26/02/2026] - Vendor contacted through several @metinfo.cn and\n@mituo.cn email addresses, no response\n\n[07/03/2026] - Tried to reach out to the vendor again, no response\n\n[28/03/2026] - Tried to reach out to the vendor once again, no response\n\n[29/03/2026] - Tried to reach out to the vendor through Weibo, no response\n\n[30/03/2026] - CVE identifier requested\n\n[31/03/2026] - CVE identifier assigned\n\n[01/04/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-29014 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-06\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:49:04Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/1"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-06"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-29014.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.metinfo.cn"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-06] MetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-29014",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0274",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1",
            "automated": true,
            "contentSha256": "060cffe051aa712afbc32aa96184935f3daa78c6cba712cdcfd82405fa2e66e3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-01T11:54:41Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0274"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-09T13:49:04Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0274"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}