CVE-2017-11200
HighSummary
FineCMS has an SQL Injection vulnerability affecting the visitor_ip parameter in application/core/controller/excludes.php. This issue was identified up to July 12, 2017.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized database queries, potentially leading to the disclosure of sensitive data or system compromise.
Recommendation
It is recommended to update FineCMS to the latest version to mitigate this vulnerability and to implement input filtering and validation.
Other vulnerabilities in FineCMS
See all- CVE-2017-11178High
In FineCMS through 2017-07-11, the application/core/controller/style.php file allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. This can lead to overwriting a .php file because the file extension is not checked.
- CVE-2017-12774Critical
FineCMS version 1.9.5 in ContentController.php allows remote attackers to manipulate the website database.
- CVE-2017-11585Critical
FineCms version 5.0.9 has a vulnerability allowing remote PHP code execution via the 'param' parameter in an action=cache request to libraries/Template.php, known as Eval Injection.
- CVE-2017-11584Critical
FineCms version 5.0.9 has a SQL Injection vulnerability via the field parameter in requests with actions module, member, form, or related to the libraries/Template.php file.
- CVE-2017-11583Critical
FineCms version 5.0.9 has a SQL Injection vulnerability via the catid parameter in an action=related request to libraries/Template.php.
- CVE-2017-11582Critical
FineCms version 5.0.9 has an SQL Injection vulnerability via the num parameter in action=related or action=tags requests to libraries/Template.php.
- CVE-2017-11167Critical
FineCMS version 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager 'Add Site' action to enter this code after a ', sequence in a domain name.
Original NVD description (English source)
SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.