CVE-2020-25560

In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the access is available, the attacker can inject malicious OS commands on “ping”, “traceroute” and “snmp” functions and execute code on the server. We also observed the same is true if the JSESSIONID is completely removed.

• CWE-798

• https://vuln.shellcoder.party/2020/09/19/cve-2020-25560-sapphireims-unauthenticated-remote-command-execution-on-server/Exploit, Third Party Advisory
• https://vuln.shellcoder.party/tags/sapphireims/Third Party Advisory
• https://vuln.shellcoder.party/2020/09/19/cve-2020-25560-sapphireims-unauthenticated-remote-command-execution-on-server/Exploit, Third Party Advisory
• https://vuln.shellcoder.party/tags/sapphireims/Third Party Advisory

Published

Aug 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25538An authenticated attacker can inject malicious code into "la…8.8
• CVE-2020-25540ThinkAdmin v6 is affected by a directory traversal vulnerabi…7.5
• CVE-2020-2555Vulnerability in the Oracle Coherence product of Oracle Fusi…9.8
• CVE-2020-25557In CMSuno 1.6.2, an attacker can inject malicious PHP code a…8.8
• CVE-2020-25559gnuplot 5.5 is affected by double free when executing print_…7.8
• CVE-2020-2556Vulnerability in the Primavera P6 Enterprise Project Portfol…7.3
• CVE-2020-25561SapphireIMS 5 utilized default sapphire:ims credentials to c…7.8
• CVE-2020-25562In SapphireIMS 5.0, there is no CSRF token present in the en…6.5
• CVE-2020-25563In SapphireIMS 5.0, it is possible to create local administr…9.8
• CVE-2020-25564In SapphireIMS 5.0, it is possible to create local administr…8.8
• CVE-2020-25565In SapphireIMS 5.0, it is possible to use the hardcoded cred…9.8
• CVE-2020-25566In SapphireIMS 5.0, it is possible to take over an account b…9.8