Executive brief
GeniXCMS, a content management system used for building websites, contains a security flaw in its media management component. An attacker with basic user permissions can bypass security filters to upload and execute malicious scripts on the server. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of services.
Technical details
An unrestricted file upload vulnerability exists in GeniXCMS through version 0.0.8 due to insufficient blacklisting of PHP file extensions in the media rename feature. While the system may block standard .php files, it fails to validate alternative extensions such as .php6, .php7, and .phtml. A remote attacker with low-level authenticated access can rename uploaded files to these executable extensions, leading to remote code execution (RCE) on the underlying web server. The vulnerability is tracked as CWE-434 and was addressed in subsequent patches on GitHub.
Affected products
- GeniXCMS GeniXCMS through 0.0.8
Timeline
- 2017-01-17: disclosed
- 2017-01-17: advisory