PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5574 Metalgenix CVE debrief

CVE-2017-5574 is a critical SQL injection vulnerability associated with GeniXCMS before 1.0.0. NVD records that the issue can be reached by an unauthenticated attacker and maps it to full confidentiality, integrity, and availability impact. The vendor references include an issue report and the v1.0.0 release, indicating the fix was delivered in that release line.

Vendor
Metalgenix
Product
Genixcms
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Administrators and developers running GeniXCMS deployments prior to 1.0.0, especially any instance exposed to the internet or allowing public registration/activation flows. Security teams should also care if they inherit or monitor legacy PHP applications that may still be running affected versions.

Technical summary

NVD classifies the flaw as CWE-89 (SQL Injection) with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is described as affecting register.php in GeniXCMS before 1.0.0, where the activation parameter can be abused by an unauthenticated user to execute arbitrary SQL commands. The NVD CPE mapping identifies vulnerable versions through 0.0.8, while the linked v1.0.0 release is the referenced patch milestone.

Defensive priority

Critical. This is network-reachable, requires no authentication, and is scored for complete CIA impact. Treat as an urgent upgrade-and-verify issue for any exposed or production GeniXCMS installation.

Recommended defensive actions

  • Upgrade GeniXCMS to version 1.0.0 or later, using the referenced release as the minimum fixed version.
  • Inventory all hosts and containers to confirm whether GeniXCMS is installed and whether any instance is on a vulnerable version.
  • Review public-facing registration and activation functionality and reduce exposure where it is not required.
  • Check application and database logs for unusual SQL errors, unexpected registration activity, or signs of tampering around the affected endpoint.
  • If compromise is suspected, rotate application secrets and review database account privileges and stored data integrity.
  • Apply least-privilege database permissions and keep the application and its dependencies patched.

Evidence notes

The debrief is based on the NVD CVE record and the linked mitigation references. The core evidence is the CVE description stating that register.php in GeniXCMS before 1.0.0 allows unauthenticated SQL injection via the activation parameter, the NVD CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the CWE-89 classification. The references to GitHub issue #69 and the v1.0.0 release support the remediation timeline. The source corpus contains a naming inconsistency: the description and references point to GeniXCMS, while the CPE mapping uses metalgenix:genixcms; this debrief preserves both as source evidence.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5574 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5574

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5574 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5574

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.