X2CRM 'SendErrorReport()' Method PHP Object Injection Vulnerability
BID:70080
Info
X2CRM 'SendErrorReport()' Method PHP Object Injection Vulnerability
| Bugtraq ID: | 70080 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-5297 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 23 2014 12:00AM |
| Updated: | Sep 23 2014 12:00AM |
| Credit: | Egidio Romano |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
X2CRM 'SendErrorReport()' Method PHP Object Injection Vulnerability
X2CRM is prone to a remote PHP object-injection vulnerability.
Attackers can exploit this issue to inject arbitrary object in to the application. This may allow an attacker to delete files or execute arbitrary PHP code through specially crafted serialized objects.
X2CRM 2.8 through 4.1.7 are vulnerable.
X2CRM is prone to a remote PHP object-injection vulnerability.
Attackers can exploit this issue to inject arbitrary object in to the application. This may allow an attacker to delete files or execute arbitrary PHP code through specially crafted serialized objects.
X2CRM 2.8 through 4.1.7 are vulnerable.
Exploit / POC
X2CRM 'SendErrorReport()' Method PHP Object Injection Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
X2CRM 'SendErrorReport()' Method PHP Object Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
X2CRM 'SendErrorReport()' Method PHP Object Injection Vulnerability
References:
References: