PT-2018-4194 · Zikula · Zikula Application Framework

Egidio Romano · Publicado 2018-03-26 · Atualizado 2018-04-24 · CVE-2014-2293

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zikula Application Framework versions prior to 1.3.7 build 11

Description The issue allows remote attackers to conduct PHP object injection attacks, potentially leading to the deletion of arbitrary files or the execution of arbitrary PHP code. This can be achieved by providing crafted serialized data in specific parameters, including the authentication method ser or authentication info ser parameter to "index.php", or the zikulaMobileTheme parameter to "index.php".

Recommendations For versions prior to 1.3.7 build 11, update to version 1.3.7 build 11 or later to resolve the issue. As a temporary workaround, consider restricting access to the "index.php" endpoint or validating and sanitizing user input for the authentication method ser, authentication info ser, and zikulaMobileTheme parameters to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-2293

Produtos afetados

Zikula Application Framework

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2293 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2293 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91787 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91786 · Nota
• http://karmainsecurity.com/KIS-2014-02 · Nota
• https://secuniaresearch.flexerasoftware.com/secunia_research/2014-2 · Nota