CVE-2017-12774
CriticalSummary
FineCMS version 1.9.5 in ContentController.php allows remote attackers to manipulate the website database.
Risk Assessment
Attackers may gain access to sensitive data and take control of the database, potentially leading to serious security consequences for the organization.
Recommendation
It is recommended to update FineCMS to the latest version to mitigate this vulnerability and implement additional security measures for the database.
Other vulnerabilities in FineCMS 1.9.5
See all- CVE-2017-11200High
FineCMS has an SQL Injection vulnerability affecting the visitor_ip parameter in application/core/controller/excludes.php. This issue was identified up to July 12, 2017.
- CVE-2017-11178High
In FineCMS through 2017-07-11, the application/core/controller/style.php file allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. This can lead to overwriting a .php file because the file extension is not checked.
- CVE-2017-11585Critical
FineCms version 5.0.9 has a vulnerability allowing remote PHP code execution via the 'param' parameter in an action=cache request to libraries/Template.php, known as Eval Injection.
- CVE-2017-11584Critical
FineCms version 5.0.9 has a SQL Injection vulnerability via the field parameter in requests with actions module, member, form, or related to the libraries/Template.php file.
- CVE-2017-11583Critical
FineCms version 5.0.9 has a SQL Injection vulnerability via the catid parameter in an action=related request to libraries/Template.php.
- CVE-2017-11582Critical
FineCms version 5.0.9 has an SQL Injection vulnerability via the num parameter in action=related or action=tags requests to libraries/Template.php.
- CVE-2017-11167Critical
FineCMS version 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager 'Add Site' action to enter this code after a ', sequence in a domain name.
Original NVD description (English source)
finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database