{"id":"CVE-2017-1000067","aliases":["EUVD-2022-4775","GHSA-phhm-6pgm-mxw9"],"status":"published","title":"MODX Revolution blind SQL injection","description":"MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01109,"percentile":0.66097,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2017-07-13T20:00:00Z","modified":"2026-10-20T10:47:32Z","fixes":[{"ecosystem":"Packagist","package":"modx/revolution","fixed_in":["2.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"modx/revolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.5.6"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"modx/revolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.6.0"}]}]}],"products":[{"vendor":"modx","product":"revolution"}],"references":[{"url":"https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000067","tags":["advisory"]},{"url":"https://github.com/modxcms/revolution/blob/2.x/core/xpdo/changelog.txt#L48","tags":["web"]},{"url":"https://github.com/advisories/GHSA-phhm-6pgm-mxw9"},{"url":"https://github.com/modxcms/revolution","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-1000067","description":"MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.","status":"published","published":"2017-07-13T20:00:00Z","modified":"2024-08-05T21:53:06.137Z","updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2022-4775","description":"MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.","status":"published","published":"2017-07-13T20:00:00Z","modified":"2024-08-05T21:53:06Z","updated_at":"2026-11-03T02:23:03.593375Z"}],"ghsa":[{"id":"GHSA-phhm-6pgm-mxw9","title":"MODX Revolution blind SQL injection","description":"MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.","status":"published","published":"2022-05-17T02:27:14Z","modified":"2024-04-23T17:23:44Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:44.335614Z"}],"nvd":[{"id":"CVE-2017-1000067","description":"MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.","status":"published","published":"2017-07-17T13:18:18.127Z","modified":"2026-06-17T00:58:40.693Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"CVE-2017-1000067","description":"MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.","status":"published","published":"2017-07-17T13:18:18.127Z","modified":"2026-10-20T10:47:32.416556099Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"GHSA-phhm-6pgm-mxw9","title":"MODX Revolution blind SQL injection","description":"MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.","status":"published","published":"2022-05-17T02:27:14Z","modified":"2024-04-23T17:43:52.899579Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}