PT-2017-13677 · Genix · Genixcms

Published 2017-09-27 · Updated 2022-05-13 · CVE-2017-14763

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeniXCMS version 1.1.4

Description The issue allows remote authenticated users to execute arbitrary PHP code via a .php file in a ZIP archive of a theme on the Install Themes page.

Recommendations For GeniXCMS version 1.1.4, consider disabling the theme installation feature until a patch is available to prevent the execution of arbitrary PHP code. Restrict access to the Install Themes page to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2017-14763

GHSA-2F6R-892P-69G5

Affected Products

Genixcms

References · 5

• 🔥 http://ph0rse.me/2017/09/21/GeniXCMS-1-1-4%E6%9C%80%E6%96%B0%E7%89%88%E6%9C%AC-getshell · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-14763 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14763 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2f6r-892p-69g5 · Vendor Advisory
• https://github.com/GeniXCMS/GeniXCMS · Note