PT-2015-5994 · Hajime Fujimoto · Mt-Phpincgi.Php

壱 · Publicado 2015-05-25 · Atualizado 2015-05-27 · CVE-2015-2945

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mt-phpincgi.php in Hajime Fujimoto mt-phpincgi versions prior to 2015-05-15

Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request. This has been exploited in the wild in May 2015.

Recommendations For versions prior to 2015-05-15, update to a version released after 2015-05-15 to resolve the issue. As a temporary workaround, consider restricting access to the mt-phpincgi.php file to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2015-2945

Produtos afetados

Mt-Phpincgi.Php

Referências · 4

• 🔥 http://h-fj.com/blog/archives/2015/05/15-112843.php · Exploit
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000067 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN64459670/index.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2945 · Nota de Segurança