CVE-2014-4672

EPSS 0.57%

Yii PHP Framework arbitrary PHP scripts execution

發布日:2022/5/17修改日:2024/12/7

描述

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

受影響套件(1)

Packagist/yiisoft/yii>= 1.1.14, < 1.1.15

參考連結(4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2014-4672
PATCHhttps://github.com/yiisoft/yii
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii/CVE-2014-4672.yaml
WEBhttps://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix