CVE-2017-5543: Subrion CMS PHP Object Injection
Summary
CVE-2017-5543: Subrion CMS PHP Object Injection. Affects intelliants/subrion versions >= 4.0.5, < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subrion CMS is a content management system that allows users to create and manage websites. It provides various features such as user management, content editing, and template customization. The vulnerability identified as CVE-2017-5543 affects Subrion CMS version 4.0.5. This vulnerability allows remote attackers to conduct PHP Object Injection attacks by exploiting a flaw in the 'includes/classes/ia.core.users.php' file. By sending crafted serialized data in a salt cookie within a login request, an attacker can inject malicious PHP objects into the application's code.
Vulnerability Detail
The vulnerability arises from a lack of proper input validation and sanitization in the affected file. When the application processes the serialized data from the salt cookie, it fails to adequately validate and sanitize the input, allowing an attacker to inject arbitrary PHP objects. This can lead to various security issues, including remote code execution, unauthorized access to sensitive data, and potential compromise of the entire application and server. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
4.1.0
This is the first release that contains the fix.
composer require intelliants/subrion:4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality or restrict access to the login feature. This can be achieved by modifying the application's configuration or using a web application firewall to block requests containing serialized data in the salt cookie. However, it is strongly recommended to apply the official fix by upgrading to the latest version of Subrion CMS.
Conclusion
The CVE-2017-5543 vulnerability in Subrion CMS version 4.0.5 allows remote attackers to conduct PHP Object Injection attacks. This can lead to severe security risks, including remote code execution and unauthorized access to sensitive data. Users of Subrion CMS are advised to upgrade to version 4.1.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for intelliants/subrion →
FAQ
Subrion CMS is a content management system that allows users to create and manage websites. It provides various features such as user management, content editing, and template customization.
PHP Object Injection is a vulnerability that occurs when an application fails to properly validate and sanitize user-supplied input. Attackers can exploit this vulnerability to inject malicious PHP objects into the application's code, potentially leading to remote code execution and other security issues.
The CVE-2017-5543 vulnerability affects Subrion CMS version 4.0.5. It allows remote attackers to conduct PHP Object Injection attacks by exploiting a flaw in the 'includes/classes/ia.core.users.php' file. By sending crafted serialized data in a salt cookie within a login request, an attacker can inject malicious PHP objects into the application's code.
The CVE-2017-5543 vulnerability can have severe consequences, including remote code execution, unauthorized access to sensitive data, and potential compromise of the entire application and server. It is crucial to patch this vulnerability to prevent these security risks.
To fix the CVE-2017-5543 vulnerability, users of Subrion CMS should upgrade to version 4.1.0 or later. This upgrade includes the necessary fixes to address the vulnerability and ensure the application's security.
References
Related vulnerabilities
Recent vulnerabilities recorded for intelliants/subrion.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.