Symfony CVE-2015-2308 PHP Code Injection Vulnerability
BID:75357
Info
Symfony CVE-2015-2308 PHP Code Injection Vulnerability
| Bugtraq ID: | 75357 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-2308 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 23 2015 12:00AM |
| Updated: | Jun 23 2015 12:00AM |
| Credit: | Takeshi Terada of Mitsui Bussan Secure Directions, Inc. |
| Vulnerable: |
Symfony Symfony 2.6.5 Symfony Symfony 2.6.4 Symfony Symfony 2.6.3 Symfony Symfony 2.6.2 Symfony Symfony 2.6.1 Symfony Symfony 2.6 Symfony Symfony 2.5.10 Symfony Symfony 2.5.9 Symfony Symfony 2.5.8 Symfony Symfony 2.5.7 Symfony Symfony 2.5.6 Symfony Symfony 2.5.5 Symfony Symfony 2.4.10 Symfony Symfony 2.3.26 Symfony Symfony 2.3.25 Symfony Symfony 2.3.24 Symfony Symfony 2.3.23 Symfony Symfony 2.3.22 Symfony Symfony 2.3.21 Symfony Symfony 2.3.20 Symfony Symfony 2.3.6 Symfony Symfony 2.3.5 Symfony Symfony 2.2.9 Symfony Symfony 2.2.8 Symfony Symfony 2.1.13 Symfony Symfony 2.1.12 Symfony Symfony 2.0.25 Symfony Symfony 2.0.24 Symfony Symfony 2.5.4 Symfony Symfony 2.5.2 Symfony Symfony 2.5.1 Symfony Symfony 2.4.9 Symfony Symfony 2.4.8 Symfony Symfony 2.4.7 Symfony Symfony 2.3.19 Symfony Symfony 2.3.18 Symfony Symfony 2.3.17 |
| Not Vulnerable: |
Symfony Symfony 2.6.6 Symfony Symfony 2.5.11 Symfony Symfony 2.3.27 |
Discussion
Symfony CVE-2015-2308 PHP Code Injection Vulnerability
Symfony is prone to a remote PHP code-injection vulnerability.
An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
Versions prior to Symfony 2.3.27, 2.5.11, and 2.6.6 are vulnerable.
Symfony is prone to a remote PHP code-injection vulnerability.
An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
Versions prior to Symfony 2.3.27, 2.5.11, and 2.6.6 are vulnerable.
Exploit / POC
Symfony CVE-2015-2308 PHP Code Injection Vulnerability
Attackers can exploit this issue through a web browser.
Attackers can exploit this issue through a web browser.
Solution / Fix
Symfony CVE-2015-2308 PHP Code Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Symfony CVE-2015-2308 PHP Code Injection Vulnerability
References:
References:
- CVE-2015-2308: Esi Code Injection (Symfony )
- Symfony Homepage (SensioLabs)
- JVN#19578958 Symfony vulnerable to code injection (JPCERT)