CVE-2017-5520
HighSummary
The media rename feature in GeniXCMS through version 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content. This allows a user to rename and execute files with the `.php6`, `.php7`, and `.phtml` extensions.
Risk Assessment
Exploitation of this vulnerability could lead to the execution of malicious code on the server, posing a serious threat to the security of the application and user data.
Recommendation
It is recommended to update GeniXCMS to the latest version and implement additional verification mechanisms for uploaded files to block unauthorized extensions.
Other vulnerabilities in GeniXCMS
See all- CVE-2017-14764High
In GeniXCMS 1.1.4, on the Upload Modules page, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module.
- CVE-2017-14763High
In GeniXCMS version 1.1.4, on the Install Themes page, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme.
- CVE-2017-8377High
GeniXCMS version 1.0.2 has an SQL Injection vulnerability in inc/lib/Control/Backend/menus.control.php via the menuid parameter.
- CVE-2017-5518High
The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address.
- CVE-2017-5347High
GeniXCMS 0.0.8 has an SQL injection vulnerability in inc/mod/newsletter/options.php that allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php.
- CVE-2017-5346High
GeniXCMS 0.0.8 has an SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php that allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php.
- CVE-2017-5345High
GeniXCMS 0.0.8 has an SQL injection vulnerability in tags-ajax.control.php that allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI.
- CVE-2016-10096High
CVE-2016-10096 is an SQL injection vulnerability in register.php in GeniXCMS before version 1.0.0 that allows remote attackers to execute arbitrary SQL commands via the activation parameter.
- CVE-2017-8827Critical
The forgotpassword.php file in GeniXCMS 1.0.2 lacks a rate limit, which may allow remote attackers to cause a denial of service (login inability) or conduct Arbitrary User Password Reset attacks.
- CVE-2017-5959Critical
In GeniXCMS before version 1.0.2, there is a vulnerability that allows CSRF token bypass, potentially leading to privilege escalation. The forgotpassword.php page can be used to acquire a token.
Original NVD description (English source)
The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the `.php6`, `.php7` and `.phtml` extensions.