CVE-2017-5574
CriticalSummary
CVE-2017-5574 is an SQL injection vulnerability in register.php in GeniXCMS before version 1.0.0 that allows unauthenticated users to execute arbitrary SQL commands via the activation parameter.
Risk Assessment
This vulnerability could lead to unauthorized access to the database, potentially resulting in data leakage or modification.
Recommendation
It is recommended to update GeniXCMS to the latest version to mitigate this vulnerability and implement additional security measures such as input validation.
Other vulnerabilities in GeniXCMS
See all- CVE-2017-14764High
In GeniXCMS 1.1.4, on the Upload Modules page, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module.
- CVE-2017-14763High
In GeniXCMS version 1.1.4, on the Install Themes page, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme.
- CVE-2017-8377High
GeniXCMS version 1.0.2 has an SQL Injection vulnerability in inc/lib/Control/Backend/menus.control.php via the menuid parameter.
- CVE-2017-5520High
The media rename feature in GeniXCMS through version 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content. This allows a user to rename and execute files with the `.php6`, `.php7`, and `.phtml` extensions.
- CVE-2017-5518High
The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address.
- CVE-2017-5347High
GeniXCMS 0.0.8 has an SQL injection vulnerability in inc/mod/newsletter/options.php that allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php.
- CVE-2017-5346High
GeniXCMS 0.0.8 has an SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php that allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php.
- CVE-2017-5345High
GeniXCMS 0.0.8 has an SQL injection vulnerability in tags-ajax.control.php that allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI.
- CVE-2016-10096High
CVE-2016-10096 is an SQL injection vulnerability in register.php in GeniXCMS before version 1.0.0 that allows remote attackers to execute arbitrary SQL commands via the activation parameter.
- CVE-2017-8827Critical
The forgotpassword.php file in GeniXCMS 1.0.2 lacks a rate limit, which may allow remote attackers to cause a denial of service (login inability) or conduct Arbitrary User Password Reset attacks.
Original NVD description (English source)
SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation parameter.