CVE-2017-14763
Description
In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
In GeniXCMS 1.1.4, authenticated users can upload a malicious theme ZIP containing a PHP file to achieve remote code execution.
Vulnerability
In GeniXCMS version 1.1.4, the Install Themes page does not properly validate the contents of uploaded ZIP archives. A remote authenticated user can upload a ZIP file containing a .php file, which is then extracted and executed on the server. This allows arbitrary PHP code execution. The vulnerability is present in the theme installation functionality [2].
Exploitation
An attacker must have a valid user account with permissions to install themes. The attacker crafts a ZIP archive containing a malicious PHP file and uploads it via the Install Themes page. The system extracts the archive and places the PHP file in the themes directory, where it can be accessed and executed by the attacker [2].
Impact
Successful exploitation leads to arbitrary PHP code execution on the web server. The attacker can then perform actions such as reading sensitive files, modifying the database, or executing system commands, potentially compromising the entire application and server [2].
Mitigation
No official patch is mentioned in the available references. The GeniXCMS project has since released version 2.4.0 [1], which may include security improvements. Users are advised to upgrade to the latest version and restrict theme installation privileges to trusted administrators only. If upgrading is not possible, consider disabling the theme installation feature or implementing additional file validation [1][2].
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- ghsa-coords
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- ph0rse.me/2017/09/21/GeniXCMS-1-1-4%E6%9C%80%E6%96%B0%E7%89%88%E6%9C%AC-getshell/nvdExploitThird Party Advisory
- github.com/advisories/GHSA-2f6r-892p-69g5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-14763ghsaADVISORY
- ph0rse.me/2017/09/21/GeniXCMS-1-1-4%E6%9C%80%E6%96%B0%E7%89%88%E6%9C%AC-getshellghsaWEB
News mentions
0No linked articles in our index yet.