CVE-2015-3933: Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL…

PriorityP265critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

3.76%

88.5th percentile

Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
genix	cms	0 – 0.0.3	—
metalgenix	genixcms	<= 0.0.3	—

Detection & IOCsextracted from sources · hover to see the quote

url/genixcms/register.php↗

path\inc\lib\User.class.php↗

→Detect SQL injection attempts targeting the `email` POST parameter in requests to register.php; look for single-quote followed by boolean/error-based SQL payloads such as `and(select ... from information_schema.tables group by x)a` ↗
→Detect SQL injection attempts targeting the `userid` POST parameter in requests to register.php using the same error-based GROUP BY technique against information_schema.tables ↗
→Monitor POST requests to register.php where either the `email` or `userid` parameter contains SQL metacharacters (single quotes, SELECT, FROM, information_schema) indicative of error-based SQL injection exploitation of CVE-2015-3933 ↗
→The vulnerable code path is `is_email()` and `is_exist()` in User.class.php; unsanitised `$vars` and `$user` are interpolated directly into SQL SELECT queries — alert on any WAF/IDS rule matching POST body SQL patterns to this endpoint ↗

·The exploit was tested specifically on Apache/2.4.7 (Win32); behaviour on other platforms or web servers may differ ↗
·The vulnerability is present in GeniXCMS versions before 0.0.3-patch; version 0.0.3 without the patch is confirmed vulnerable ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.