Security readout for executives and security teams
Plain-English summary
CVE-2017-9451 is a cross-site scripting issue in flatCore 1.4.6. A crafted acp.php URL path can cause attacker-controlled JavaScript to appear in generated page URLs because PHP_SELF was used without sanitization. Business risk depends on whether vulnerable flatCore instances and relevant administrative pages are reachable.
Executive priority
Treat as a targeted web application remediation item, not a confirmed emergency. Prioritize if flatCore 1.4.6 is internet-facing or used by privileged administrators.
Technical view
The reported flaw is in pages.edit_form.php in flatCore 1.4.6. The code generated URLs from unsanitized $_SERVER['PHP_SELF'], allowing JavaScript injection through PATH_INFO on an acp.php URL. The bundle provides no CVSS, CWE, or confirmed affected CPE data beyond the flatCore 1.4.6 description.
Likely exposure
Likely exposure is limited to organizations running flatCore CMS 1.4.6 with reachable acp.php paths. The source bundle does not confirm authentication requirements, deployment defaults, or whether later versions are affected.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no provided source states active exploitation. The issue is remotely triggerable through crafted URL path data, but the bundle does not provide evidence of public weaponization.
Researcher notes
Evidence is sparse: the CVE description, GitHub issue, and commit identify the vulnerable file, version, input vector, and root cause. No CVSS, CWE, CPE, exploit status, or fixed release version is supplied in the bundle.
Mitigation direction
- Review and apply the upstream flatCore commit referenced for this CVE.
- Upgrade from flatCore 1.4.6 when vendor guidance identifies a fixed release.
- Check flatCore issue 34 for vendor context and remediation notes.
- Limit exposure of acp.php administrative paths where operationally possible.
Validation and detection
- Inventory internet-facing and internal systems for flatCore CMS 1.4.6.
- Review pages.edit_form.php for unsanitized $_SERVER['PHP_SELF'] URL generation.
- Confirm whether the referenced upstream commit is present in deployed code.
- Check access logs for unusual acp.php PATH_INFO requests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9451 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/flatCore/flatCore-CMS/commit/f1b42b338693a9c240182e76ef2131057f2c2a87CVE reference · x_refsource_CONFIRM
- https://github.com/flatCore/flatCore-CMS/issues/34CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.