MetalGenix GeniXCMS vulnerable to SQL Injection

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2015-3933 · ADVISORY
• GeniXCMS/GeniXCMS · PACKAGE
• semplon/GeniXCMS release v0.0.3-patch · WEB
• exploit-db.com/exploits/37363 · WEB
• exploit-db.com/exploits/37363 · Third Party Advisory

genix/cms のその他の脆弱性

• CVE-2022-24563中 5.4In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_…
• CVE-2017-14740中 4.8Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the …
• CVE-2017-17431中 6.1GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761…
• CVE-2017-14765中 6.1In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request.
• CVE-2017-14764高 8.8In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of …