GitHub Advisoryadvisory · Packagist

GHSA-c95f-27gx-6vq9 phpWhois arbitrary code execution via a crafted whois record

CRITICAL Published 2022-05-14 Modified 2024-04-23 Official page ↗
Aliases
CVE-2015-5243
Ecosystem
Packagist
Packages
jsmitty12/phpwhois, phpwhois/phpwhois, brightlocal/phpwhois, david-garcia/phpwhois, ivankristianto/phpwhois, kazist/phpwhois, serluck/phpwhois, simple-updates/phpwhois, truckersmp/phpwhois
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-04-23

Affected packages

• Packagist jsmitty12/phpwhois: < 5.1.0 → fixed in 5.1.0 • Packagist phpwhois/phpwhois: <= 4.2.5 (no fix yet) • Packagist brightlocal/phpwhois: <= 4.2.5 (no fix yet) • Packagist david-garcia/phpwhois: <= 4.3.1 (no fix yet) • Packagist ivankristianto/phpwhois: <= 4.3.0 (no fix yet) • Packagist kazist/phpwhois: <= 4.2.6 (no fix yet) • Packagist serluck/phpwhois: <= 4.2.6 (no fix yet) • Packagist simple-updates/phpwhois: <= 1.0.0 (no fix yet) • Packagist truckersmp/phpwhois: <= 4.3.1 (no fix yet)

Description

phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

Related

Alias · CVE (1)

  • CVE-2015-5243 phpWhois allows remote attackers to execute arbitrary code via a crafted whois record. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References