CVE-2017-16920

Critical

Published: 21/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In dayrui FineCms version 5.2.0, the v5/config/system.php file has a default SYS_KEY value and does not require key regeneration for each installation. This allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.

Risk Assessment

Attackers can exploit this vulnerability to upload malicious code, potentially leading to system takeover and data leakage.

Recommendation

It is recommended to change the default SYS_KEY value and implement a mechanism that enforces key regeneration for each installation.

Original NVD description (English source)

v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.