# CVE-2017-5575: GeniXCMS SQL injection in Options.class.php

Source: https://junglewise.ai/threats/cve-2017-5575-genixcms-sql-injection-in-options-class-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5575 · Severity: critical · CVSS 9.8 · Published 2017-01-23

GeniXCMS, a content management system, is vulnerable to a critical security flaw that allows remote attackers to interfere with its database. By sending specially crafted requests, an attacker can view, modify, or delete sensitive information stored in the system's database without needing a password. This could lead to a total compromise of the website, including the theft of user data or the disruption of services.

Technologies: [Metalgenix Genixcms](https://junglewise.ai/threats/technologies/genixcms). Vendors: [Metalgenix](https://junglewise.ai/threats/vendors/metalgenix).

## Quick answers

**Is CVE-2017-5575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5575 being exploited in the wild.

**How severe is CVE-2017-5575?** Critical severity, with a CVSS score of 9.8, published 23 January 2017.

**Which products and versions are affected?** GeniXCMS GeniXCMS before 1.0.0.

**Is there a fix for CVE-2017-5575?** A patch was published on 2017-01-22: GeniXCMS v1.0.0 released fixing the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5575 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2017-5575?** Check whether you run Metalgenix Genixcms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in GeniXCMS versions prior to 1.0.0 within the 'inc/lib/Options.class.php' component. The vulnerability is caused by improper neutralization of special elements used in SQL commands, specifically affecting the 'modules' parameter. A remote, unauthenticated attacker can exploit this by sending a malicious network request to execute arbitrary SQL commands against the underlying database. This can result in full unauthorized access to data, modification of database records, or administrative bypass. The issue was addressed in the v1.0.0 release.

## Affected products

- GeniXCMS GeniXCMS before 1.0.0

## Timeline

- 2017-01-22: patched: GeniXCMS v1.0.0 released fixing the issue.
- 2017-01-23: advisory: NVD published the CVE record.

## References

- [http://www.securityfocus.com/bid/95703](http://www.securityfocus.com/bid/95703)
- [https://github.com/semplon/GeniXCMS/issues/68](https://github.com/semplon/GeniXCMS/issues/68)
- [https://github.com/semplon/GeniXCMS/releases/tag/v1.0.0](https://github.com/semplon/GeniXCMS/releases/tag/v1.0.0)

## Related threats

- [GeniXCMS SQL injection in register.php](https://junglewise.ai/threats/cve-2017-5574-genixcms-sql-injection-in-register-php)
- [GeniXCMS unrestricted file upload in media rename feature](https://junglewise.ai/threats/cve-2017-5520-genixcms-unrestricted-file-upload-in-media-rename-feature)
- [GeniXCMS SQL injection in Posts.class.php](https://junglewise.ai/threats/cve-2017-5519-genixcms-sql-injection-in-posts-class-php)
- [GeniXCMS SSRF in media-file upload feature](https://junglewise.ai/threats/cve-2017-5518-genixcms-ssrf-in-media-file-upload-feature)
- [GeniXCMS SQL injection in author.control.php](https://junglewise.ai/threats/cve-2017-5517-genixcms-sql-injection-in-author-control-php)