CVE-2017-1000067

MODX Revolution versions 2.x through 2.5.6 are affected by a blind SQL injection due to improper sanitization in the escape method. This vulnerability can allow an authenticated user to access the database and potentially escalate privileges. No explicit remediation/version patch is provided in t...

PT-2017-10774

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.x through 2.5.6 Description The issue is caused by improper sanitization by the escape method, resulting in blind SQL injection. This allows an authenticated user to access the database and possibly escalate...

Arbitrary File Upload Vulnerability in MODX Revolution

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. An arbitrary file upload vulnerability exists in MODX Revolution. The vulnerability is due to improper...

ModX CMS Proof Of Concept Shell Upload

c@kali:/src/Napalm2.2/libs$ cat shell-modxcms.py !/usr/bin/env python shell-modxcms.py - upload shell for modx 2.5.6-pl !! we need rwx in modx-webdir to go ;Z 30.05.217 @ code610 blogspot com import requests import re target=rawinput"Hostname " print '+ Preparing tests for ' + strtarget session =...

MODX Revolution Arbitrary Code Execution Vulnerability

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. An arbitrary code execution vulnerability exists in versions of MODX Revolution prior to 2.5.7. The...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2017-07466)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in versions of MODX Revolution prior to 2.5.7. A remote...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2017-07467)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in versions of MODX Revolution prior to 2.5.7. A remote...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2017-07468)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in versions of MODX Revolution prior to 2.5.7. A remote...

MODX Revolution Directory Traversal Vulnerability (CNVD-2017-07464)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in MODX Revolution versions prior to 2.5.7 using PHP version...

Directory traversal

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

Cross site scripting

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...

Design/Logic Flaw

In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning...

CVE-2017-9069

In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess...

CVE-2017-9071

In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning...

Cross site scripting

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9070

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9067

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

CVE-2017-9068

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...

CVE-2017-9069

In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess...

CVE-2017-9068

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...