GeniXCMS Arbitrary PHP Code Execution in genix/cms
Summary
CVE-2017-14763: GeniXCMS arbitrary PHP code execution. Affects genix/cms versions 1.1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeniXCMS is a content management system that allows users to create and manage websites. It provides various features such as theme installation, user authentication, and content editing. However, a vulnerability has been discovered in version 1.1.4 of GeniXCMS that allows remote authenticated users to execute arbitrary PHP code. This vulnerability exists in the Install Themes page, where a user can upload a ZIP archive containing a theme. By including a .php file in the ZIP archive, an attacker can execute malicious PHP code on the server.
Vulnerability Detail
The vulnerability in GeniXCMS 1.1.4 allows remote authenticated users to execute arbitrary PHP code by uploading a ZIP archive containing a theme. This can lead to various consequences, including unauthorized access to sensitive data, server compromise, and further exploitation of the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the theme installation feature or restrict access to the Install Themes page. This can be done by modifying the configuration settings or implementing access controls at the server level. However, this workaround may limit the functionality of the CMS and should only be considered until a proper fix is applied.
Conclusion
In conclusion, GeniXCMS version 1.1.4 is vulnerable to arbitrary PHP code execution through the theme installation feature. This can result in unauthorized access and compromise of the affected system. It is crucial to update GeniXCMS to a patched version as soon as possible to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for genix/cms →
FAQ
GeniXCMS is a content management system that allows users to create and manage websites. It provides features such as theme installation, user authentication, and content editing.
The vulnerability occurs in the Install Themes page, where a user can upload a ZIP archive containing a theme. By including a .php file in the ZIP archive, an attacker can execute arbitrary PHP code on the server.
The vulnerability can lead to unauthorized access to sensitive data, server compromise, and further exploitation of the affected system.
The vulnerability has a CVSS score of 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to update GeniXCMS to a version that includes a patch for this issue. Users should update their installations to the latest patched version as soon as it becomes available.
References
Related vulnerabilities
Recent vulnerabilities recorded for genix/cms.
