CVE-2017-11585
CriticalSummary
FineCms version 5.0.9 has a vulnerability allowing remote PHP code execution via the 'param' parameter in an action=cache request to libraries/Template.php, known as Eval Injection.
Risk Assessment
Exploitation of this vulnerability could lead to remote execution of arbitrary code on the server, posing a serious security threat to the application and its data.
Recommendation
It is recommended to update FineCms to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in FineCms 5.0.9
See all- CVE-2017-11200High
FineCMS has an SQL Injection vulnerability affecting the visitor_ip parameter in application/core/controller/excludes.php. This issue was identified up to July 12, 2017.
- CVE-2017-11178High
In FineCMS through 2017-07-11, the application/core/controller/style.php file allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. This can lead to overwriting a .php file because the file extension is not checked.
- CVE-2017-12774Critical
FineCMS version 1.9.5 in ContentController.php allows remote attackers to manipulate the website database.
- CVE-2017-11584Critical
FineCms version 5.0.9 has a SQL Injection vulnerability via the field parameter in requests with actions module, member, form, or related to the libraries/Template.php file.
- CVE-2017-11583Critical
FineCms version 5.0.9 has a SQL Injection vulnerability via the catid parameter in an action=related request to libraries/Template.php.
- CVE-2017-11582Critical
FineCms version 5.0.9 has an SQL Injection vulnerability via the num parameter in action=related or action=tags requests to libraries/Template.php.
- CVE-2017-11167Critical
FineCMS version 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager 'Add Site' action to enter this code after a ', sequence in a domain name.
Original NVD description (English source)
dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection.