GCVE-1988-2026-0274

Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:22
VLAI
Title
[KIS-2026-06] MetInfo CMS <= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability
Summary
--------------------------------------------------------------------------- MetInfo CMS <= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability --------------------------------------------------------------------------- [-] Software Link: https://www.metinfo.cn [-] Affected Versions: Versions 7.9, 8.0, and 8.1. [-] Vulnerability Description: The vulnerable code is located into the /app/system/weixin/include/class/weixinreply.class.php script. Specifically, within the weixinreply::wxAdminLogin() method: 149. public function wxAdminLogin($data = array(),$code = '') 150. { 151. global $_M; 152. $weixinapi = load::mod_class('weixin/weixinapi','new'); 153. $login_code = cache::get("weixin/".$code); 154. if ($login_code) { 155. cache::put("weixin/".$login_code,$data['FromUserName']); 156. } 157. return; 158. } User input passed through the "EventKey" and "FromUserName" XML tags from the HTTP request body when dispatching weixin API requests is not properly sanitized before being used in a call to the cache::get() and cache::put() methods respectively. Specifically, the $code parameter may include Path Traversal sequences, making the cache::get() method into including arbitrary PHP files. This can be abused to set the $login_code variable to the "Array" string by including an arbitrary cache file. Subsequently, the cache::put() method will write the "FromUserName" parameter into the /cache/weixin/Array.php file, embedding it within double quotes: 30. public static function put($file, $data, $type = 'php') 31. { 32. global $_M; 33. 34. load::sys_func('file'); 35. $save = PATH_CACHE . $file . '.' . $type; 36. makefile($save); 37. #$data = str_replace(array("\"", "\\"), array("\\\"", "\\\\"), $data); 38. if (!is_array($data)) { 39. file_put_contents($save, "<?php\ndefined('IN_MET') or exit('No permission');\n\$cache=\"{$data}\";\n?>"); 40. } else { 41. $info = var_export($data, true); 42. $info = "<?php\ndefined('IN_MET') or exit('No permission');\n\$cache = {$info};\n?>"; 43. file_put_contents($save, $info); 44. } 45. } This can be exploited by remote, unauthenticated attackers to inject and execute arbitrary PHP code by abusing PHP's complex curly syntax, leading to unauthenticated Remote Code Execution (RCE). NOTE: when MetInfo is running on non-Windows servers, successful exploitation of this vulnerability requires the /cache/weixin/ directory to exist, which is created when installing and configuring the official WeChat plugin. [-] Proof of Concept: https://karmainsecurity.com/pocs/CVE-2026-29014.php [-] Solution: No official solution is currently available. [-] Disclosure Timeline: [26/02/2026] - Vendor contacted through several @metinfo.cn and @mituo.cn email addresses, no response [07/03/2026] - Tried to reach out to the vendor again, no response [28/03/2026] - Tried to reach out to the vendor once again, no response [29/03/2026] - Tried to reach out to the vendor through Weibo, no response [30/03/2026] - CVE identifier requested [31/03/2026] - CVE identifier assigned [01/04/2026] - Public disclosure [-] CVE Reference: CVE-2026-29014 has been assigned to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: https://karmainsecurity.com/KIS-2026-06 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Metinfo Cms Metinfo Cms Affected: unknown
guessed Create a notification for this product.
Credits
Egidio Romano
Relationships
reference GCVE-1988-2026-0274 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Metinfo Cms",
          "vendor": "Metinfo Cms",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "---------------------------------------------------------------------------\nMetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability\n---------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.metinfo.cn\n\n\n[-] Affected Versions:\n\nVersions 7.9, 8.0, and 8.1.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located into the\n/app/system/weixin/include/class/weixinreply.class.php script.\n\nSpecifically, within the weixinreply::wxAdminLogin() method:\n\n149.     public function wxAdminLogin($data = array(),$code = \u0027\u0027)\n150.     {\n151.         global $_M;\n152.         $weixinapi = load::mod_class(\u0027weixin/weixinapi\u0027,\u0027new\u0027);\n153.         $login_code = cache::get(\"weixin/\".$code);\n154.          if ($login_code) {\n155.             cache::put(\"weixin/\".$login_code,$data[\u0027FromUserName\u0027]);\n156.          }\n157.         return;\n158.     }\n\nUser input passed through the \"EventKey\" and \"FromUserName\" XML tags\nfrom the HTTP request body when dispatching weixin API requests is not\nproperly sanitized before being used in a call to the cache::get() and\ncache::put() methods respectively.\n\nSpecifically, the $code parameter may include Path Traversal\nsequences, making the cache::get() method into including arbitrary PHP\nfiles. This can be abused to set the $login_code variable to the\n\"Array\" string by including an arbitrary cache file. Subsequently, the\ncache::put() method will write the \"FromUserName\" parameter into the\n/cache/weixin/Array.php file, embedding it within double quotes:\n\n30.     public static function put($file, $data, $type = \u0027php\u0027)\n31.     {\n32.         global $_M;\n33.\n34.         load::sys_func(\u0027file\u0027);\n35.         $save = PATH_CACHE . $file . \u0027.\u0027 . $type;\n36.         makefile($save);\n37.         #$data = str_replace(array(\"\\\"\", \"\\\\\"), array(\"\\\\\\\"\",\n\"\\\\\\\\\"), $data);\n38.         if (!is_array($data)) {\n39.             file_put_contents($save, \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or\nexit(\u0027No permission\u0027);\\n\\$cache=\\\"{$data}\\\";\\n?\u003e\");\n40.         } else {\n41.             $info = var_export($data, true);\n42.             $info = \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or exit(\u0027No\npermission\u0027);\\n\\$cache = {$info};\\n?\u003e\";\n43.             file_put_contents($save, $info);\n44.         }\n45.     }\n\nThis can be exploited by remote, unauthenticated attackers to inject\nand execute arbitrary PHP code by abusing PHP\u0027s complex curly syntax,\nleading to unauthenticated Remote Code Execution (RCE).\n\nNOTE: when MetInfo is running on non-Windows servers, successful\nexploitation of this vulnerability requires the /cache/weixin/\ndirectory to exist, which is created when installing and configuring\nthe official WeChat plugin.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-29014.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[26/02/2026] - Vendor contacted through several @metinfo.cn and\n@mituo.cn email addresses, no response\n\n[07/03/2026] - Tried to reach out to the vendor again, no response\n\n[28/03/2026] - Tried to reach out to the vendor once again, no response\n\n[29/03/2026] - Tried to reach out to the vendor through Weibo, no response\n\n[30/03/2026] - CVE identifier requested\n\n[31/03/2026] - CVE identifier assigned\n\n[01/04/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-29014 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-06\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:22:09Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/1"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-06"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-29014.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.metinfo.cn"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-06] MetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-29014",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0274",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1",
            "automated": true,
            "contentSha256": "060cffe051aa712afbc32aa96184935f3daa78c6cba712cdcfd82405fa2e66e3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-01T11:54:41Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0274"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-11T11:22:09Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0274"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.