Vulnerability CVE-2014-4672


Published: 2014-07-03

Description:
The CDetailView widget in Yii PHP Framework before 1.1.15 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

Type:

CWE-94

(Improper Control of Generation of Code ('Code Injection'))

Vendor: Yiiframework
Product: Yiiframework 
Version: 1.1.14;

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/

Related CVE
CVE-2018-6010
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode, related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/e...
CVE-2018-6009
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
CVE-2017-11516
An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.
CVE-2015-3397
Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.

Copyright 2019, cxsecurity.com

 

Back to Top