GitHub Advisoryadvisory · Packagist

GHSA-74qv-rv53-5wcx Yii PHP Framework arbitrary PHP scripts execution

HIGH Published 2022-05-17 Modified 2024-04-24 Official page ↗
Aliases
CVE-2014-4672
Ecosystem
Packagist
Packages
yiisoft/yii
Severity
High
Weaknesses
CWE-94
Reviewed
2024-04-24

Affected packages

• Packagist yiisoft/yii: >= 1.1.14, < 1.1.15 → fixed in 1.1.15

Description

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

Related

Alias · CVE (1)

  • CVE-2014-4672 The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References