GHSA-3mpg-q26j-83j5

ghsaUSosv

Command injection in yiisoft/yii2-gii

view advisory published 2023-01-21Licence: CC-BY-4.0

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-36655US	high8.8	1.46% (73rd)	—	2023-01-21
Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model fi…

references

External citations — patches, advisories, analysis.

https://github.com/yiisoft/yii2-giiPACKAGE
https://github.com/yiisoft/yii2-gii/commit/ed61e0d85f43e23f79d7c9d1b4e5e5c09a32ce4bWEB
https://github.com/yiisoft/yii2-gii/issues/433WEB
https://lab.wallarm.com/yii2-gii-remote-code-executionWEB
https://nvd.nist.gov/vuln/detail/CVE-2020-36655ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan