GitHub Advisoryadvisory · Packagist

GHSA-cp2p-6xh4-jmcp nterchange Code Injection vulnerability

CRITICAL Published 2023-01-02 Modified 2023-10-20 Official page ↗
Aliases
CVE-2015-10009
Ecosystem
Packagist
Packages
nonfiction/nterchange
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2023-10-20

Affected packages

• Packagist nonfiction/nterchange: < 4.1.1 → fixed in 4.1.1

Description

A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file `app/controllers/code_caller_controller.php`. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/* leads to code injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.1 is able to address this issue. The name of the patch is fba7d89176fba8fe289edd58835fe45080797d99. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217187.

Related

Alias · CVE (1)

  • CVE-2015-10009 A vulnerability was found in nterchange up to 4.1.0. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References