CVE-2014-4672

EPSS 0.57%

Yii PHP Framework arbitrary PHP scripts execution

Published: 5/17/2022Modified: 12/7/2024

Description

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

Affected packages (1)

Packagist/yiisoft/yii>= 1.1.14, < 1.1.15

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2014-4672
PATCHhttps://github.com/yiisoft/yii
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii/CVE-2014-4672.yaml
WEBhttps://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix