PT-2017-13677 · Genix · Genixcms

Publicado 2017-09-27 · Atualizado 2022-05-13 · CVE-2017-14763

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeniXCMS version 1.1.4

Description The issue allows remote authenticated users to execute arbitrary PHP code via a .php file in a ZIP archive of a theme on the Install Themes page.

Recommendations For GeniXCMS version 1.1.4, consider disabling the theme installation feature until a patch is available to prevent the execution of arbitrary PHP code. Restrict access to the Install Themes page to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2017-14763

GHSA-2F6R-892P-69G5

Produtos afetados

Genixcms

Referências · 5

• 🔥 http://ph0rse.me/2017/09/21/GeniXCMS-1-1-4%E6%9C%80%E6%96%B0%E7%89%88%E6%9C%AC-getshell · Exploit
• https://github.com/GeniXCMS/GeniXCMS · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14763 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-14763 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2f6r-892p-69g5 · Aviso do Fabricante