CVE-2017-11178
HighSummary
In FineCMS through 2017-07-11, the application/core/controller/style.php file allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. This can lead to overwriting a .php file because the file extension is not checked.
Risk Assessment
Attackers can exploit this vulnerability to introduce malicious code on the server, potentially leading to system takeover or data leakage.
Recommendation
It is recommended to update FineCMS to the latest version and implement file extension validation mechanisms in the application.
Other vulnerabilities in FineCMS
See all- CVE-2017-11200High
FineCMS has an SQL Injection vulnerability affecting the visitor_ip parameter in application/core/controller/excludes.php. This issue was identified up to July 12, 2017.
- CVE-2017-12774Critical
FineCMS version 1.9.5 in ContentController.php allows remote attackers to manipulate the website database.
- CVE-2017-11585Critical
FineCms version 5.0.9 has a vulnerability allowing remote PHP code execution via the 'param' parameter in an action=cache request to libraries/Template.php, known as Eval Injection.
- CVE-2017-11584Critical
FineCms version 5.0.9 has a SQL Injection vulnerability via the field parameter in requests with actions module, member, form, or related to the libraries/Template.php file.
- CVE-2017-11583Critical
FineCms version 5.0.9 has a SQL Injection vulnerability via the catid parameter in an action=related request to libraries/Template.php.
- CVE-2017-11582Critical
FineCms version 5.0.9 has an SQL Injection vulnerability via the num parameter in action=related or action=tags requests to libraries/Template.php.
- CVE-2017-11167Critical
FineCMS version 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager 'Add Site' action to enter this code after a ', sequence in a domain name.
Original NVD description (English source)
In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked.