GitHub Advisoryadvisory · Packagist
GHSA-48r9-4v93-x4wh DOMPDF Remote File Inclusion Vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2010-4879
- Ecosystem
- Packagist
- Packages
- dompdf/dompdf
- Severity
- High
- Weaknesses
- CWE-94
- Reviewed
- 2024-04-25
Affected packages
• Packagist dompdf/dompdf: >= 0.6, < 0.6.1 → fixed in 0.6.1
Description
PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the `input_file` parameter.
Related
Alias · CVE (1)
- CVE-2010-4879 PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL… vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2010-4879 advisory
- https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2010-4879.yaml web
- https://github.com/dompdf/dompdf package
- https://github.com/dompdf/dompdf/releases/tag/v0.6.2 web
- https://github.com/dompdf/dompdf/wiki/Securing-dompdf web
- http://www.exploit-db.com/exploits/14851 web