CVE-2017-11167

Critical

Published: 12/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

FineCMS version 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager 'Add Site' action to enter this code after a ', sequence in a domain name.

Risk Assessment

Exploitation of this vulnerability could lead to full server compromise, posing a serious threat to the organization's data security.

Recommendation

It is recommended to update FineCMS to the latest version and implement input validation filters in the URL Manager.

Original NVD description (English source)

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo() input value.