GitHub Advisoryadvisory · Packagist

GHSA-2f6r-892p-69g5 GeniXCMS arbitrary PHP code execution

HIGH Published 2022-05-13 Modified 2024-04-25 Official page ↗

Aliases: CVE-2017-14763
Ecosystem: Packagist
Packages: genix/cms
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reviewed: 2024-04-25

Affected packages

• Packagist genix/cms: 1.1.4 (no fix yet)

Description

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme.

Related

Alias · CVE (1)

CVE-2017-14763 In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of… vulnerability

References