Zikula Application Framework <= 1.3.6 Multiple PHP Object Injection Vulnerabilities

2014.11.30
Credit: Egidio Romano
Risk: High
Local: No
Remote: Yes
CWE: CWE-94


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Zikula Application Framework <= 1.3.6 Multiple PHP Object Injection Vulnerabilities Software Link: http://zikula.org/ Affected Versions: Version 1.3.6 and probably prior versions. Vulnerabilities Description: 1) Input passed via the authentication_method_ser and authentication_info_ser POST parameters to index.php (when module is set to users, func is set to register, csrftoken is set to a valid value, and registration_info is set to an arbitrary value) is not properly sanitised before being used in a call to the unserialize() function. This can be exploited to e.g. delete arbitrary files or inject and execute arbitrary PHP code via specially crafted serialized objects. 2) Input passed via the zikulaMobileTheme cookie parameter to index.php is not properly sanitised before being used in a call to the unserialize() function in the /lib/util/SecurityUtil.php script. This can be exploited to e.g. delete arbitrary files or inject and execute arbitrary PHP code via specially crafted serialized objects sent in a Cookie header. Solution: Update to version 1.3.7. Disclosure Timeline: [16/01/2014] Request for contact details [16/01/2014] Vendor response [21/01/2014] Vendor notified [26/01/2014] Vendor response, fix scheduled for mid February [17/02/2014] Vendor releases updates [10/03/2014] Public disclosure &#8226; CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-2293 to these vulnerabilities.

References:

http://zikula.org/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top