CVE-2017-8377

In GeniXCMS 1.1.4, on the Upload Modules page, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module.

In GeniXCMS version 1.1.4, on the Install Themes page, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme.

The media rename feature in GeniXCMS through version 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content. This allows a user to rename and execute files with the `.php6`, `.php7`, and `.phtml` extensions.

The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address.

GeniXCMS 0.0.8 has an SQL injection vulnerability in inc/mod/newsletter/options.php that allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php.

GeniXCMS 0.0.8 has an SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php that allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php.

GeniXCMS 0.0.8 has an SQL injection vulnerability in tags-ajax.control.php that allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI.

CVE-2016-10096 is an SQL injection vulnerability in register.php in GeniXCMS before version 1.0.0 that allows remote attackers to execute arbitrary SQL commands via the activation parameter.

The forgotpassword.php file in GeniXCMS 1.0.2 lacks a rate limit, which may allow remote attackers to cause a denial of service (login inability) or conduct Arbitrary User Password Reset attacks.

In GeniXCMS before version 1.0.2, there is a vulnerability that allows CSRF token bypass, potentially leading to privilege escalation. The forgotpassword.php page can be used to acquire a token.