GitHub Advisoryadvisory · Packagist

GHSA-5cmg-8m8p-whmj GeniXCMS arbitrary PHP code execution

HIGH Published 2022-05-17 Modified 2024-04-25 Official page ↗

Aliases: CVE-2017-14764
Ecosystem: Packagist
Packages: genix/cms
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-94
Reviewed: 2024-04-25

Affected packages

• Packagist genix/cms: 1.1.4 (no fix yet)

Description

In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module.

Related

Alias · CVE (1)

CVE-2017-14764 In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of… vulnerability

Weakness · CWE (1)

CWE-94 Improper Control of Generation of Code weakness

References