Fiyo CMS 2.0.7 vulnerabilities

20 known CVE vulnerabilities in Fiyo CMS 2.0.7, translated and rated.

CVE-2017-17104High
Fiyo CMS version 2.0.7 has an arbitrary file read vulnerability in check_file.php that can be exploited via the $_GET['src'] or $_GET['name'] parameters.
CVE-2017-17103High
Fiyo CMS version 2.0.7 has SQL injection vulnerability in /apps/app_user/sys_user.php via $_POST[name] or $_POST[email]. This vulnerability can lead to escalation from normal user privileges to administrator privileges.
CVE-2017-17102High
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in /system/site.php via the $_REQUEST['link'] parameter.
CVE-2014-9147High
Fiyo CMS version 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in the .backup/ directory.
CVE-2017-11630High
Fiyo CMS version 2.0.7 contains a vulnerability that allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request.
CVE-2017-8853High
Fiyo CMS version 2.0.7 has an arbitrary file delete vulnerability in backuper.php via directory traversal in the file parameter during an act=db action.
CVE-2017-6823High
Fiyo CMS version 2.0.6.1 allows remote authenticated users to gain elevated privileges via a modified level parameter in the app=user&act=edit action.
CVE-2014-9145High
Fiyo CMS version 2.0.1.8 has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. Attackers can exploit various parameters such as id, cat, user, level, email, and username to carry out an attack.
CVE-2015-3934Critical
Fiyo CMS 2.0_1.9.1 has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be carried out via the 'id' parameter in rating.php or the 'user' parameter in the login process.
CVE-2014-9148Critical
Fiyo CMS version 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the super administrator functions 'Install and Update' or 'Backup' via the view parameter in a direct request to fiyo/dapur.
CVE-2017-11631Critical
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in status.php that uses the id parameter.
CVE-2017-11419Critical
Fiyo CMS version 2.0.7 has SQL injection vulnerability in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].
CVE-2017-11418Critical
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in article_list.php that uses the parameters $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$i].
CVE-2017-11417Critical
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in article_status.php that uses the $_GET['id'] parameter.
CVE-2017-11416Critical
Fiyo CMS version 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.
CVE-2017-11415Critical
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].
CVE-2017-11414Critical
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in dapur/apps/app_comment/sys_comment.php, using data from $_POST and $_REQUEST.
CVE-2017-11413Critical
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in comment_status.php that uses the $_GET['id'] parameter.
CVE-2017-11412Critical
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in comment_status.php via the $_GET['id'] parameter.
CVE-2017-11354Critical
Fiyo CMS version 2.0.7 has an SQL injection vulnerability in sys_article.php via the name parameter when editing or adding a tag name.