CVE-2017-1000067: SQL Injection
Published Jul 13, 2017
·Updated
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.
Affected Software
38 affected componentsFixes available
composer/modx/revolution>=2.0.0<=2.5.6
2.6.0
MODX Revolution=2.0.0
MODX Revolution=2.0.0-rc1
MODX Revolution=2.0.0-rc2
MODX Revolution=2.0.0-rc3
MODX Revolution=2.0.1
MODX Revolution=2.1.0
MODX Revolution=2.1.0-p12
MODX Revolution=2.1.1
MODX Revolution=2.1.1-p12
MODX Revolution=2.1.2
MODX Revolution=2.1.3
MODX Revolution=2.1.4
MODX Revolution=2.1.5
MODX Revolution=2.2.0
MODX Revolution=2.2.0-rc1
MODX Revolution=2.2.0-rc2
MODX Revolution=2.2.0-rc3
MODX Revolution=2.2.1
MODX Revolution=2.2.2
MODX Revolution=2.2.3
MODX Revolution=2.2.4
MODX Revolution=2.2.5
MODX Revolution=2.2.6
MODX Revolution=2.2.7
MODX Revolution=2.2.8
MODX Revolution=2.2.9
MODX Revolution=2.3.0
MODX Revolution=2.3.1
MODX Revolution=2.4.0
MODX Revolution=2.4.1
MODX Revolution=2.5.0
MODX Revolution=2.5.1
MODX Revolution=2.5.2
MODX Revolution=2.5.3
MODX Revolution=2.5.4
MODX Revolution=2.5.5
MODX Revolution=2.5.6
Event History
Jul 13, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·02:27 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-1000067?
The severity of CVE-2017-1000067 is classified as high due to potential exploitation by authenticated users to execute blind SQL injections.
2
How do I fix CVE-2017-1000067?
To fix CVE-2017-1000067, upgrade MODX Revolution to version 2.6.0 or later.
3
Which versions of MODX Revolution are affected by CVE-2017-1000067?
Versions of MODX Revolution from 2.0.0 up to 2.5.6 are affected by CVE-2017-1000067.
4
What type of attack is possible with CVE-2017-1000067?
CVE-2017-1000067 allows for blind SQL injection attacks that can lead to unauthorized database access and privilege escalation.
5
Is authentication required to exploit CVE-2017-1000067?
Yes, CVE-2017-1000067 requires an authenticated user to exploit the vulnerability.