CVE-2017-9067
HighSummary
In MODX Revolution before version 2.5.7, when using PHP 5.3.3, an attacker can include and execute arbitrary files on the web server due to insufficient validation of the action parameter in setup/index.php, leading to a directory traversal attack.
Risk Assessment
The organization is exposed to the risk of remote code execution, which may lead to server takeover and data leakage.
Recommendation
It is recommended to upgrade MODX Revolution to version 2.5.7 or later and implement additional security mechanisms to validate parameters.
Other vulnerabilities in MODX Revolution
See all- CVE-2017-1000067High
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method, allowing authenticated users to access the database and possibly escalate privileges.
- CVE-2017-9069High
In MODX Revolution before version 2.5.7, a user with file upload permissions can execute arbitrary code by uploading a file named .htaccess.
- CVE-2017-7322High
MODX Revolution versions 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers in the update and package-installation features, allowing man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate.
- CVE-2016-10039High
In MODX Revolution before version 2.5.2-pl, there is a directory traversal vulnerability in /connectors/index.php that allows remote attackers to manipulate local files via a crafted dir parameter.
- CVE-2016-10038High
In MODX Revolution before version 2.5.2-pl, there is a directory traversal vulnerability in /connectors/index.php that allows remote attackers to manipulate local files via a crafted dir parameter.
- CVE-2016-10037High
In MODX Revolution before version 2.5.2-pl, there is a directory traversal vulnerability in /connectors/index.php that allows remote attackers to manipulate local files via a crafted id (also known as dir) parameter.
- CVE-2014-2736High
Multiple SQL injection vulnerabilities in MODX Revolution before version 2.2.14 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit the session ID (PHPSESSID) in index.php or user parameters in connectors/security/message.php and id in manager/index.php.
- CVE-2014-2311High
SQL injection vulnerability in modx.class.php in MODX Revolution versions 2.0.0 to 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2017-7324Critical
The findcore.php file in MODX Revolution version 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.
- CVE-2017-7321Critical
In MODX Revolution version 2.5.4-pl and earlier, the setup/controllers/welcome.php file allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI.
Original NVD description (English source)
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.