Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-17889: Kliqqi CMS lets attackers inject malicious code via group names

CVE-2017-17889 · published 8 years ago

Summary

The Kliqqi content management system can be tricked into running unwanted scripts when a group name, homepage text, or tag description is crafted in a certain way. This could let attackers display false information or steal data from visitors to the site. Apply the latest software update or patch that corrects this behavior as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
kliqqi	kliqqi_cms	3.5.2 `cpe:2.3:a:kliqqi:kliqqi_cms:3.5.2:::::::*`

Original advisory text

Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags or Description within pligg/submit.php.

References

https://edricteo.com/kliqqi-cms-xss-vulnerability-in-version-3.5.2/ Exploit Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published22 Apr 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-17889 · NVD

Track software like this

Free during beta