Subrion CMS PHP Object Injection

CRITICAL 9.8CVE-2017-5543 · GHSA-4j79-4m6q-77vf · Published 20/01/2017 · updated 17/06/2026

In short

CVE-2017-5543 is a CRITICAL (CVSS 9.8) vulnerability affecting intelliants/subrion, subrion (intelliants).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.0% of all vulnerabilities.
Fix: update to 4.1.0 or later.

Package	Affected versions	Patched versions
intelliants/subrion Packagist	`≥ 4.0.5, < 4.1.0`	`4.1.0`
subrion intelliants	`= 4.0.5`	No fix yet

Description

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

NVD description

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

References

nvd.nist.gov/vuln/detail/CVE-2017-5543 · ADVISORY
intelliants/subrion · WEB
intelliants/subrion commit 019dee2 · WEB
intelliants/subrion · PACKAGE
securityfocus.com/bid/95688 · WEB

More vulnerabilities in intelliants/subrion

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

intelliants/subrion

Packagist

≥ 4.0.5, < 4.1.0

4.1.0

subrion

intelliants

= 4.0.5

No fix yet

Description

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

NVD description

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

More vulnerabilities in intelliants/subrion

See all →