GeniXCMS Cross-site Scripting (XSS) via the Menu ID field

Description

References

• nvd.nist.gov/vuln/detail/CVE-2017-14765 · ADVISORY
• GeniXCMS/GeniXCMS · PACKAGE
• ph0rse.me/2017/09/21/GeniXCMS-1-1-4%E6%9C%80%E6%96%B0%E7%89%88%E6%9C%AC-getshell · WEB
• ph0rse.me/2017/09/21/GeniXCMS-1-1-4%E6%9C%80%E6%96%B0%E7%89%88%E6%9C%AC-getshell · Exploit

genix/cms 的其他漏洞

• CVE-2022-24563中危 5.4In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_…
• CVE-2017-14740中危 4.8Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the …
• CVE-2017-17431中危 6.1GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761…
• CVE-2015-3933严重 9.8Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute…
• CVE-2017-14764高危 8.8In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of …