VULNERABILITY INTELLIGENCE

CVE-2017-7324

CVSS score9.8 CRITICAL

EPSS probability2.16%

CISA KEVNot currently listed

Published2017-03-30

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.

Weakness classification

CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references

cve@mitre.org — Third Party Advisory, VDB Entry
cve@mitre.org — Exploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Technical Description, Third Party Advisory