VORANT. Threat Intelligence Sign in Get the full feed

bingo!CMS auth bypass exploited in wild

elevated vulnerability

Attackers are exploiting an authentication bypass in bingo!CMS to upload malicious files without logging in, per the vendor.

IPA and JVN have issued an alert for bingo!CMS, a content management system from Shift Tech Inc., warning of an authentication bypass vulnerability in part of its administrative functionality. By accessing a specific URL, an attacker can bypass login authentication and upload a file containing malicious code to the affected management interface, potentially leading to remote code execution on the server.

The vendor has confirmed that this vulnerability is being actively exploited in the wild, and users are urged to apply the developer-provided update as soon as possible. The vulnerability has been scored 7.5 (Important/警告) under CVSS v3 and 5.0 under CVSS v2, reflecting a network-exploitable, low-complexity attack path that requires no authentication.

Related reporting

Detection guidance

bingo!CMS Authentication Bypass Exploitation Attempt

ATT&CK T1190

Detection of HTTP requests to bingo!CMS administrative endpoints that bypass authentication via specific URL path patterns, indicating exploitation of CVE in bingo!CMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: bingo!CMS Authentication Bypass Exploitation Attempt
description: Detects HTTP requests to bingo!CMS administrative interface using authentication
  bypass vulnerability. Matches requests to known vulnerable URL paths in bingo!CMS
  that allow unauthenticated access to file upload functionality.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection_cms_auth_bypass:
    c-uri|contains:
    - /admin
    - /management
    c-uri|endswith:
    - .php
    - .asp
    - .aspx
    cs-method: GET
  filter_legitimate_auth:
    cs-cookie|contains: session
  condition: selection_cms_auth_bypass and not filter_legitimate_auth
falsepositives:
- Legitimate administrator access without session cookies (e.g., first login attempt)
- Security scanners probing CMS endpoints
level: high
id: 64d7c006-1a31-5fd0-85fa-ecfc81f61077
status: experimental
author: Vorant

bingo!CMS Malicious File Upload to Administrative Directory

ATT&CK T1190

Detection of file uploads to bingo!CMS management interface following authentication bypass, with executable or script file extensions indicative of webshell deployment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: bingo!CMS Malicious File Upload to Administrative Directory
description: Detects POST/PUT requests uploading executable or script files to bingo!CMS
  administrative directories, typically following authentication bypass exploitation.
  Targets common webshell extensions and upload endpoints.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection_upload_request:
    cs-method:
    - POST
    - PUT
    c-uri|contains: upload
  selection_webshell_ext:
    c-uri|endswith:
    - .php
    - .php3
    - .php4
    - .php5
    - .phtml
    - .asp
    - .aspx
    - .jsp
    - .jspx
    - .sh
  filter_legitimate_cms_update:
    cs-user-agent|contains:
    - bingo!CMS
    - official-updater
  condition: (selection_upload_request and selection_webshell_ext) and not filter_legitimate_cms_update
falsepositives:
- Legitimate content updates by administrators uploading plugins or themes in PHP
- Software update mechanisms from trusted vendors
level: high
id: 821820e8-896e-5d46-846a-dea66d2fafab
status: experimental
author: Vorant

bingo!CMS Post-Exploitation Web Request Pattern

ATT&CK T1190

Detection of suspicious HTTP requests to newly uploaded files in bingo!CMS administrative directories, indicative of webshell execution following exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: bingo!CMS Post-Exploitation Web Request Pattern
description: Detects HTTP GET/POST requests to recently uploaded executable files
  within bingo!CMS administrative upload directories, matching post-exploitation webshell
  invocation patterns.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: proxy
  product: proxy
detection:
  selection_admin_upload_access:
    c-uri|contains: upload
    c-uri|endswith:
    - .php
    - .asp
    - .aspx
    - .jsp
  selection_execution_pattern:
    cs-method:
    - GET
    - POST
    cs-uri-query|contains:
    - cmd=
    - command=
    - exec=
    - system=
  condition: selection_admin_upload_access or selection_execution_pattern
falsepositives:
- Legitimate administrator testing of uploaded PHP utilities with query parameters
- CMS plugins using command-style query parameters for legitimate administrative functions
level: medium
id: dc58eace-80d0-537c-8e9a-cb350c066a38
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20221011-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free