fiyo - MidnightBSD Security Advisories

CVE-2014-4032 MEDIUM

Cross-site scripting (XSS) vulnerability in apps/app_comment/form_comment.php in Fiyo CMS 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the Nama field.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	1.5.7

CVE-2014-9145 HIGH

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an edit action to dapur/index.php; (2) cat, (3) user, or (4) level parameter to dapur/apps/app_article/controller/article_list.php; or (5) email parameter in an email action or (6) username parameter in a user action to dapur/apps/app_user/controller/check_user.php.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.1.8

CVE-2014-9146 MEDIUM

Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) id, (3) page, or (4) app parameter to the default URI or the (5) act parameter to dapur/index.php.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.1.8

CVE-2014-9147 MEDIUM

Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-200,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	*

CVE-2014-9148 HIGH

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-284,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	*

CVE-2015-3934 HIGH

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.1.9.1

CVE-2017-11354 HIGH

Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name parameter in editing or adding a tag name.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11412 HIGH

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id'].

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11413 HIGH

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11414 HIGH

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name'], $_POST['web'], $_POST['email'], $_POST['status'], $_POST['id'], and $_REQUEST['id'].

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11415 HIGH

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11416 HIGH

Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11417 HIGH

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id'].

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11418 HIGH

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$i].

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11419 HIGH

Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11630 MEDIUM

dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-22,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-11631 HIGH

dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-13778 MEDIUM

Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-17102 MEDIUM

Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $_REQUEST['link'].

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-17103 MEDIUM

Fiyo CMS 2.0.7 has SQL injection in /apps/app_user/sys_user.php via $_POST[name] or $_POST[email]. This vulnerability can lead to escalation from normal user privileges to administrator privileges.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-17104 HIGH

Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php via $_GET['src'] or $_GET['name'].

CVSS 2.0

Severity: HIGH

Problem Type: CWE-200,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2017-6823 MEDIUM

Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-294,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.6.1

CVE-2017-7625 HIGH

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs/save_file.php" and then execute code.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-94,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0
fiyo	fiyo_cms	2.0.7
fiyo	fiyo_cms	2.0.1.6
fiyo	fiyo_cms	2.0.1.8
fiyo	fiyo_cms	2.0.2.1
fiyo	fiyo_cms	2.0.6

CVE-2017-8853 MEDIUM

Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php via directory traversal in the file parameter during an act=db action.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-22,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2018-18545 MEDIUM

Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.7

CVE-2020-35373 MEDIUM

In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
fiyo	fiyo_cms	2.0.6.1

Advisories for fiyo