CVE-2017-5346: GeniXCMS SQL Injection Vulnerability
Summary
CVE-2017-5346: GeniXCMS SQL injection vulnerability. Affects genix/cms versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeniXCMS is an open-source content management system (CMS) that allows users to create and manage websites. It provides various features such as user authentication, content creation, and database management. The vulnerability in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands through a SQL injection attack. This vulnerability exists in the 'inc/lib/Control/Backend/posts.control.php' file, specifically in the 'id' parameter of the 'gxadmin/index.php' endpoint.
Vulnerability Detail
The SQL injection vulnerability in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands by manipulating the 'id' parameter in the 'gxadmin/index.php' endpoint. An attacker with administrative privileges can exploit this vulnerability to perform unauthorized actions on the database, such as extracting sensitive information, modifying data, or even gaining complete control over the system. This vulnerability has a CVSS score of 7.2, indicating a high severity level.
How To Fix
Minimum fixed version
1.0.0
This is the first release that contains the fix.
composer require genix/cms:1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the 'gxadmin/index.php' endpoint or disable the affected functionality until the system can be updated to a secure version. However, applying the fix by upgrading to GeniXCMS 1.0.0 or later is strongly recommended.
Conclusion
The SQL injection vulnerability in GeniXCMS 0.0.8 poses a significant risk to systems running this version. It is crucial to upgrade to GeniXCMS 1.0.0 or later to mitigate this vulnerability. Implementing proper input validation and sanitization techniques is essential to prevent SQL injection attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for genix/cms →
FAQ
GeniXCMS is an open-source content management system (CMS) that allows users to create and manage websites.
This vulnerability allows remote authenticated administrators to execute arbitrary SQL commands, potentially leading to unauthorized access, data manipulation, or system compromise.
To fix this vulnerability, upgrade to GeniXCMS version 1.0.0 or later and ensure proper input validation and sanitization techniques are implemented.
As a temporary workaround, restrict access to the affected endpoint or disable the functionality until the system can be updated.
This vulnerability has a CVSS score of 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for genix/cms.
