GeniXCMS Mailbox validation logic vulnerability in genix/cms
Summary
CVE-2017-8388: GeniXCMS Mailbox validation logic vulnerability. Affects genix/cms versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeniXCMS is a content management system that allows users to create and manage websites. It provides features such as user registration, email validation, and content editing. The vulnerability in the genix/cms package allows remote attackers to bypass the email validation mechanism, leading to potential security issues.
Vulnerability Detail
The vulnerability in GeniXCMS 1.0.2 exists in the mailbox validation logic. By sending a specific request to register.php?act=edit&id=1, remote attackers can bypass the alertDanger MSG_USER_EMAIL_EXIST protection mechanism. This can potentially allow unauthorized access to user accounts or manipulation of user data.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
composer require genix/cms:1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the genix/cms package to the latest version to mitigate the risk.
Conclusion
The mailbox validation logic vulnerability in the genix/cms package of GeniXCMS 1.0.2 can be exploited by remote attackers to bypass email validation and potentially gain unauthorized access to user accounts. It is crucial to update the genix/cms package to version 1.1.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for genix/cms →
FAQ
GeniXCMS is a content management system that allows users to create and manage websites. It provides features such as user registration, email validation, and content editing.
The vulnerability allows remote attackers to bypass the email validation mechanism, potentially leading to unauthorized access to user accounts or manipulation of user data.
Yes, updating the genix/cms package to version 1.1.0 or later fixes the vulnerability.
No, updating the genix/cms package to the latest version is the recommended solution.
You can find more information about this vulnerability in the GeniXCMS advisory on GitHub: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for genix/cms.
