GeniXCMS Arbitrary PHP Code Execution in genix/cms
Summary
CVE-2017-14764: GeniXCMS arbitrary PHP code execution. Affects genix/cms versions 1.1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeniXCMS is a content management system that allows users to create and manage websites. It provides various features such as user management, file uploads, and module installation. However, a vulnerability has been discovered in version 1.1.4 of GeniXCMS that allows remote authenticated users to execute arbitrary PHP code. This vulnerability exists in the Upload Modules page, where a user can upload a ZIP archive containing a .php file. The uploaded file is not properly validated, allowing an attacker to execute malicious code on the server.
Vulnerability Detail
The vulnerability in GeniXCMS 1.1.4 allows remote authenticated users to execute arbitrary PHP code by uploading a .php file within a ZIP archive of a module. This can lead to various consequences, including unauthorized access to sensitive data, server compromise, and further exploitation of the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the module upload functionality in GeniXCMS until the patch is applied. This can be done by modifying the configuration or permissions of the application to restrict access to the Upload Modules page. By preventing users from uploading modules, the risk of exploitation can be mitigated.
Conclusion
In conclusion, the vulnerability in GeniXCMS 1.1.4 allows remote authenticated users to execute arbitrary PHP code by uploading a .php file within a ZIP archive of a module. This can have severe consequences, including unauthorized access and server compromise. It is crucial to apply the provided fix and ensure proper file upload validation to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for genix/cms →
FAQ
GeniXCMS is a content management system that allows users to create and manage websites. It provides features such as user management, file uploads, and module installation.
The vulnerability occurs in the Upload Modules page, where a user can upload a ZIP archive containing a .php file. The uploaded file is not properly validated, allowing an attacker to execute arbitrary PHP code on the server.
The vulnerability can lead to unauthorized access to sensitive data, server compromise, and further exploitation of the affected system. An attacker can execute arbitrary PHP code, potentially gaining full control over the server.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to a patched version of GeniXCMS. Users should update their installation to the latest version available and ensure that file uploads are properly validated and restricted.
References
Related vulnerabilities
Recent vulnerabilities recorded for genix/cms.
