Slim PHP Framework 'SessionCookie.php' PHP Object Injection Vulnerability
BID:70087
Info
Slim PHP Framework 'SessionCookie.php' PHP Object Injection Vulnerability
| Bugtraq ID: | 70087 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-2171 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 02 2015 12:00AM |
| Updated: | Mar 02 2015 12:00AM |
| Credit: | Scott Arciszewski |
| Vulnerable: |
Josh Lockhart Slim PHP Framework 2.5 |
| Not Vulnerable: |
Josh Lockhart Slim PHP Framework 2.6 |
Discussion
Slim PHP Framework 'SessionCookie.php' PHP Object Injection Vulnerability
Slim PHP Framework is prone to a remote PHP object-injection vulnerability.
Attackers can exploit this issue to inject arbitrary object in to the application. This may allow an attacker to delete files or execute arbitrary PHP code through specially crafted serialized objects.
Slim PHP Framework 2.5.0 and prior versions are vulnerable.
Slim PHP Framework is prone to a remote PHP object-injection vulnerability.
Attackers can exploit this issue to inject arbitrary object in to the application. This may allow an attacker to delete files or execute arbitrary PHP code through specially crafted serialized objects.
Slim PHP Framework 2.5.0 and prior versions are vulnerable.
Exploit / POC
Slim PHP Framework 'SessionCookie.php' PHP Object Injection Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
Slim PHP Framework 'SessionCookie.php' PHP Object Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Slim PHP Framework 'SessionCookie.php' PHP Object Injection Vulnerability
References:
References:
- Slim Home Page (slimframework)
- PHP Object Injection Vulnerability in SessionCookie.php (GitHub)