# CVE-2017-5543: Intelliants Subrion CMS PHP Object Injection in ia.core.users.php

Source: https://junglewise.ai/threats/cve-2017-5543-intelliants-subrion-cms-php-object-injection-in-ia-core-users-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-20. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5543 · Severity: critical · CVSS 9.8 · Published 2017-01-20

Subrion CMS, a content management system used for building websites, contains a critical security flaw in its login process. An attacker can send a specially crafted web request that tricks the system into executing unauthorized code. This could allow a remote attacker to take full control of the website, access sensitive user data, or disrupt operations without needing a password.

Technologies: [Intelliants Subrion CMS](https://junglewise.ai/threats/technologies/subrion-cms), [intelliants/subrion (Packagist)](https://junglewise.ai/threats/technologies/intelliants-subrion). Vendors: [Intelliants](https://junglewise.ai/threats/vendors/intelliants), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2017-5543 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5543 being exploited in the wild.

**How severe is CVE-2017-5543?** Critical severity, with a CVSS score of 9.8, published 20 January 2017.

**Which products and versions are affected?** Intelliants Subrion CMS 4.0.5; intelliants/subrion (Packagist) ECOSYSTEM:introduced=4.0.5,fixed=4.1.0.

**Is there a fix for CVE-2017-5543?** Yes. intelliants/subrion (Packagist): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5543 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2017-5543?** Check whether you run Intelliants Subrion, Intelliants Subrion CMS or intelliants/subrion (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- intelliants/subrion (Packagist): upgrade to 4.1.0 or later

  ```sh
  composer require intelliants/subrion:^4.1.0
  ```


## Technical details

A PHP Object Injection vulnerability exists in Subrion CMS 4.0.5 within the `includes/classes/ia.core.users.php` file. The application improperly handles user-supplied data by passing the 'salt' cookie directly into the `unserialize()` function during a login request. A remote, unauthenticated attacker can exploit this by providing a crafted serialized object in the cookie. This triggers PHP magic methods such as `__wakeup()` or `__destruct()`, which can be leveraged to achieve arbitrary code execution or unauthorized file manipulation. The issue was addressed in version 4.1.0.

## Affected products

- Intelliants Subrion CMS 4.0.5

## Identifiers

- CVE-2017-5543
- GHSA-4j79-4m6q-77vf

## Timeline

- 2017-01-17: disclosed: Issue reported on GitHub
- 2017-01-20: advisory: NVD published CVE-2017-5543

## References

- [http://www.securityfocus.com/bid/95688](http://www.securityfocus.com/bid/95688)
- [https://github.com/intelliants/subrion/issues/297](https://github.com/intelliants/subrion/issues/297)

## Related threats

- [Intelliants Subrion CMS open redirect in login](https://junglewise.ai/threats/cve-2026-96773-a-weakness-has-been-identified-in-intelliants-subrion-cms-up-to-4)
- [Intelliants Subrion CMS authentication bypass in member enumeration](https://junglewise.ai/threats/cve-2026-96772-a-security-flaw-has-been-discovered-in-intelliants-subrion-cms-up)
- [Intelliants Subrion CMS path traversal in file deletion](https://junglewise.ai/threats/cve-2026-72604-intelliants-subrion-cms-path-traversal-in-file-deletion)
- [Intelliants Subrion CMS stored XSS in Blocks Endpoint](https://junglewise.ai/threats/cve-2026-12202-intelliants-subrion-cms-stored-xss-in-blocks-endpoint)
- [Subrion CMS vulnerable to cross-site scripting](https://junglewise.ai/threats/cve-2025-70958-subrion-cms-vulnerable-to-cross-site-scripting)