CVE-2017-11585

Critical

Published: 24/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

FineCms version 5.0.9 has a vulnerability allowing remote PHP code execution via the 'param' parameter in an action=cache request to libraries/Template.php, known as Eval Injection.

Risk Assessment

Exploitation of this vulnerability could lead to remote execution of arbitrary code on the server, posing a serious security threat to the application and its data.

Recommendation

It is recommended to update FineCms to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection.