Pimcore 'Zend_Http_Response_Stream' PHP Object Injection Vulnerability
BID:67615
Info
Pimcore 'Zend_Http_Response_Stream' PHP Object Injection Vulnerability
| Bugtraq ID: | 67615 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-2922 |
| Remote: | Yes |
| Local: | No |
| Published: | May 26 2014 12:00AM |
| Updated: | May 26 2014 12:00AM |
| Credit: | Pedro Ribeiro of Agile Information Security |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Pimcore 'Zend_Http_Response_Stream' PHP Object Injection Vulnerability
Pimcore is prone to a remote PHP object-injection vulnerability.
Attackers can exploit this issue to inject arbitrary object in to the application. This may allow an attacker to delete files or execute arbitrary PHP code through specially crafted serialized objects.
Versions prior to Pimcore 1.4.9 through 2.1.0 are vulnerable.
Pimcore is prone to a remote PHP object-injection vulnerability.
Attackers can exploit this issue to inject arbitrary object in to the application. This may allow an attacker to delete files or execute arbitrary PHP code through specially crafted serialized objects.
Versions prior to Pimcore 1.4.9 through 2.1.0 are vulnerable.
Exploit / POC
Pimcore 'Zend_Http_Response_Stream' PHP Object Injection Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
Pimcore 'Zend_Http_Response_Stream' PHP Object Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Pimcore 'Zend_Http_Response_Stream' PHP Object Injection Vulnerability
References:
References:
- Pimcore Homepage (Pimcore)