CVEvulnerability
CVE-2014-2293
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-03-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the (1) authentication_method_ser or (2) authentication_info_ser parameter to index.php, or (3) zikulaMobileTheme parameter to index.php.
Affected configurations
• zikula zikula application framework (<= 1.3.6)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://karmainsecurity.com/KIS-2014-02 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91786 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91787 Third Party Advisory, VDB Entry
- https://secuniaresearch.flexerasoftware.com/secunia_research/2014-2/ Third Party Advisory
- http://karmainsecurity.com/KIS-2014-02 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91786 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91787 Third Party Advisory, VDB Entry
- https://secuniaresearch.flexerasoftware.com/secunia_research/2014-2/ Third Party Advisory