SB2017050114 - Multiple vulnerabilities in MetalGenix GeniXCMS
Published: May 1, 2017 Updated: August 8, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Improper Authentication (CVE-ID: CVE-2017-8827)
The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.
forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) or possibly conduct Arbitrary User Password Reset attacks via a series of requests.
2) Cross-site scripting (CVE-ID: CVE-2017-8780)
The vulnerability allows a remote privileged user to read and manipulate data.
GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element.
3) Cross-site scripting (CVE-ID: CVE-2017-8762)
The vulnerability allows a remote authenticated user to read and manipulate data.
GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element.
4) Cross-site scripting (CVE-ID: CVE-2017-8376)
The vulnerability allows a remote authenticated user to read and manipulate data.
GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator.
5) SQL injection (CVE-ID: CVE-2017-8377)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the menuid parameter. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
6) Input validation error (CVE-ID: CVE-2017-8388)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG_USER_EMAIL_EXIST protection mechanism via a register.php?act=edit&id=1 request.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.