GHSA-74qv-rv53-5wcx

ghsaUSosv

Yii PHP Framework arbitrary PHP scripts execution

view advisory published 2022-05-17Licence: CC-BY-4.0

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2014-4672US	high7.5	2.12% (82nd)	—	2014-07-03
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

references

External citations — patches, advisories, analysis.

https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii/CVE-2014-4672.yamlWEB
https://github.com/yiisoft/yiiPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2014-4672ADVISORY
https://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fixWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan