concrete5 'system/registration/open.php' Arbitrary PHP Code Execution Vulnerability

Bugtraq ID:	75197
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 15 2015 12:00AM
Updated:	Jun 15 2015 12:00AM
Credit:	Egidio Romano of Minded Security.
Vulnerable:	concrete5 concrete5 5.7.3 concrete5 concrete5 5.7.2 concrete5 concrete5 5.7.1 concrete5 concrete5 5.7 concrete5 concrete5 5.6 concrete5 concrete5 5.4.2 concrete5 concrete5 5.7.3.1 concrete5 concrete5 5.7.2.1 concrete5 concrete5 5.6.3.1 concrete5 concrete5 5.6.3 concrete5 concrete5 5.6.2.1 concrete5 concrete5 5.6.2 concrete5 concrete5 5.6.1.2 concrete5 concrete5 5.6.1 concrete5 concrete5 5.6.0.2 concrete5 concrete5 5.5.2.1 concrete5 concrete5 5.4.2.2 concrete5 concrete5 5.4.2.1
Not Vulnerable:	concrete5 concrete5 5.7.4

concrete5 'system/registration/open.php' Arbitrary PHP Code Execution Vulnerability

concrete5 is prone to an arbitrary PHP code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server process.

concrete5 'system/registration/open.php' Arbitrary PHP Code Execution Vulnerability

An attacker can exploit this issue using a web browser.

concrete5 'system/registration/open.php' Arbitrary PHP Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

concrete5 'system/registration/open.php' Arbitrary PHP Code Execution Vulnerability

References:

• Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability (Karma(In)Security)
  
• Concrete5 Homepage (Portland Labs)
  
• Sendmail Remote Code Execution Vulnerability in Concrete5 version 5.7.3.1 (HackerOne)