CVE-2015-2679

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-03-23 · updated 2026-06-17
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) username parameter to gxadmin/login.php.

Affected products

Genixcms: through 0.0.1

References

http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17
http://blog.metalgenix.com/update-security-fix-and-add-newsletter-module/16
http://osvdb.org/show/osvdb/119392
http://osvdb.org/show/osvdb/119393
http://packetstormsecurity.com/files/130770/GeniXCMS-0.0.1-SQL-Injection.html
http://www.exploit-db.com/exploits/36321
http://www.securityfocus.com/bid/73297
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5232.php
https://github.com/semplon/GeniXCMS/commit/698245488343396185b1b49e7482ee5b25541815
https://github.com/semplon/GeniXCMS/issues/7
http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17
http://blog.metalgenix.com/update-security-fix-and-add-newsletter-module/16

Get alerted when CVE-2015-2679 or the next vulnerability affects your stack