PT-2015-5994 · Hajime Fujimoto · Mt-Phpincgi.Php

壱 · Published 2015-05-25 · Updated 2015-05-27 · CVE-2015-2945

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mt-phpincgi.php in Hajime Fujimoto mt-phpincgi versions prior to 2015-05-15

Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request. This has been exploited in the wild in May 2015.

Recommendations For versions prior to 2015-05-15, update to a version released after 2015-05-15 to resolve the issue. As a temporary workaround, consider restricting access to the mt-phpincgi.php file to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2015-2945

Affected Products

Mt-Phpincgi.Php

References · 4

• 🔥 http://h-fj.com/blog/archives/2015/05/15-112843.php · Exploit
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000067 · Vendor Advisory
• http://jvn.jp/en/jp/JVN64459670/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2945 · Security Note