blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2017-9067

HIGH 7.0 CVSS 3.0
Published
May 18, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-22
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.

Affected products and versions

  • PHP versions 5.3.3

References

  • citadelo.com https://citadelo.com/en/2017/04/modx-revolution-cms/ Exploit, Third Party Advisory
  • github.com https://github.com/modxcms/revolution/pull/13422 Third Party Advisory
  • github.com https://github.com/modxcms/revolution/pull/13428 Third Party Advisory
  • nvd.nist.gov Official NVD record