PT-2018-4194 · Zikula · Zikula Application Framework

Egidio Romano · Published 2018-03-26 · Updated 2018-04-24 · CVE-2014-2293

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zikula Application Framework versions prior to 1.3.7 build 11

Description The issue allows remote attackers to conduct PHP object injection attacks, potentially leading to the deletion of arbitrary files or the execution of arbitrary PHP code. This can be achieved by providing crafted serialized data in specific parameters, including the authentication method ser or authentication info ser parameter to "index.php", or the zikulaMobileTheme parameter to "index.php".

Recommendations For versions prior to 1.3.7 build 11, update to version 1.3.7 build 11 or later to resolve the issue. As a temporary workaround, consider restricting access to the "index.php" endpoint or validating and sanitizing user input for the authentication method ser, authentication info ser, and zikulaMobileTheme parameters to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-2293

Affected Products

Zikula Application Framework

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-2293 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2293 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91787 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91786 · Note
• http://karmainsecurity.com/KIS-2014-02 · Note
• https://secuniaresearch.flexerasoftware.com/secunia_research/2014-2 · Note