OpenPNE <= 3.8.9 (opSecurityUser.class.php) PHP Object Injection Vulnerability
All versions from 3.6.0 to 3.6.13.
All versions from 3.8.0 to 3.8.9.
The vulnerable code is located in the getRememberLoginCookie() method defined in /lib/user/opSecurityUser.class.php:
protected function getRememberLoginCookie()
$key = md5(sfContext::getInstance()->getRequest()->getHost());
if ($value = sfContext::getInstance()->getRequest()->getCookie($key))
$value = unserialize(base64_decode($value));
User input passed through cookies is not properly sanitized before being used in an unserialize() call at line 150. This could be exploited to delete arbitrary files or execute arbitrary PHP code via specially crafted serialized objects sent in a “Cookie” header.
Update to version 18.104.22.168 or 22.214.171.124.
[20/11/2013] Vendor notified
[16/12/2013] Vendor acknowledges report and states fixed releases planned for January 2014
[27/12/2013] Vendor creates patches and states fixed releases planned for January 20, 2014
[08/01/2014] Vulnerability details sent to IPA Security Center
[20/01/2014] Vendor released fixed versions
[20/01/2014] Public disclosure
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-5350 to this vulnerability.