Medium severity6.1NVD Advisory· Published Apr 1, 2017· Updated May 13, 2026
CVE-2017-7391
CVE-2017-7391
Description
A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dweeves/magmiPackagist | < 0.7.24 | 0.7.24 |
Affected products
1- cpe:2.3:a:magmi_project:magmi:0.7.22:*:*:*:*:*:*:*
Patches
1a9566b141b58Merge pull request #525 from bestshow/master
1 file changed · +1 −1
magmi/web/ajax_gettime.php+1 −1 modified@@ -1,2 +1,2 @@ <?php -echo $_REQUEST["prefix"] . ":" . strftime("%c"); +echo htmlspecialchars($_REQUEST["prefix"]).":".strftime("%c”);
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- github.com/dweeves/magmi-git/issues/522nvdIssue TrackingPatchThird Party AdvisoryWEB
- github.com/dweeves/magmi-git/pull/525nvdIssue TrackingPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-r8vh-cm9f-rc29ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-7391ghsaADVISORY
- github.com/dweeves/magmi-git/commit/a9566b141b58bf40a9dd904a74e6efcc225a28a3ghsaWEB
- web.archive.org/web/20210125191718/http://www.securityfocus.com/bid/97311ghsaWEB
- www.securityfocus.com/bid/97311nvd
News mentions
0No linked articles in our index yet.