CVE-2017-6823

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.6.1

Description The issue allows remote authenticated users to gain privileges by modifying the level parameter in the /dapur/ endpoint with an app=user&act=edit action.

Recommendations For Fiyo CMS version 2.0.6.1, consider restricting access to the /dapur/ endpoint with app=user&act=edit action until a patch is available. As a temporary workaround, avoid using the modified level parameter in this endpoint to minimize the risk of exploitation.