CVE-2016-10096 GeniXCMS SQL injection vulnerability

What is CVE-2016-10096?

CVE-2016-10096 is a high-severity SQL injection vulnerability in n/a, published on 1 Jan 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activation parameter.

Weakness: CWE-89

Which versions are affected by CVE-2016-10096?

2 open source packages ship an affected version, including genix/cms. It affects 1 product.

Products include Genixcms Genixcms.

How do I fix CVE-2016-10096?

Upgrade genix/cms to 1.0.0 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2016-10096 being exploited?

There is no known exploitation of CVE-2016-10096 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-8827 GeniXCMS Arbitrary User Password Reset Vulnerability Critical 9.1
• CVE-2017-14763 GeniXCMS arbitrary PHP code execution High 8.8
• CVE-2017-14764 GeniXCMS arbitrary PHP code execution High 8.8
• CVE-2017-8377 GeniXCMS SQL Injection High 8.8
• CVE-2015-2679 SQL injection in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gjcj-fj23-5j5v.