Securimage HTML Injection

MITTEL 6.1CVE-2017-14077 · GHSA-q6v4-xjp2-8ggv · Published 18/11/2017 · updated 17/06/2026

Kurz gesagt

CVE-2017-14077 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in dapphp/securimage, securimage (phpcaptcha).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.81%, höher als bei 57.3% aller Schwachstellen.
Abhilfe: auf 3.6.6 oder neuer aktualisieren.

Package	Affected versions	Patched versions
dapphp/securimage Packagist	`< 3.6.6`	`3.6.6`
securimage phpcaptcha	`≤ 3.6.4`	No fix yet

Description

HTML Injection in Securimage prior to 3.6.6 allows remote attackers to inject arbitrary HTML into an e-mail message body via the $_SERVER['HTTP_USER_AGENT'] parameter to example_form.ajax.php or example_form.php.

NVD description

HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $_SERVER['HTTP_USER_AGENT'] parameter to example_form.ajax.php or example_form.php.

References

nvd.nist.gov/vuln/detail/CVE-2017-14077 · ADVISORY
dapphp/securimage commit 2c7ce3f · WEB
advisory.checkmarx.net/advisory/CX-2017-4223 · WEB
dapphp/securimage · PACKAGE
checkmarx.com/advisories/html-injection-securimage · WEB
checkmarx.com/advisories/html-injection-securimage · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free