CVE-2017-14979 | BDVDB-2026-91152 Detail

Description#

Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/Blck4/blck4/blob/master/Gxlcms%20POC.php

Exploit#

No public exploit known

History#

Version 12017-10-02Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.