CVE-2010-4335

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.

Score

CVSS 2.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2011-01-14

Last modified

2024-08-07

Weaknesses

CWE-20

Affected products

• Cakephp (Cakefoundation)
• Cakephp (Cakephp)

References

• http://malloc.im/CakePHP-unserialize.txt
• http://packetstormsecurity.org/files/view/95847/burnedcake.py.txt
• http://secunia.com/advisories/42211
• http://securityreason.com/securityalert/8026
• http://www.exploit-db.com/exploits/16011
• http://www.osvdb.org/69352
• https://github.com/cakephp/cakephp/commit/e431e86aa4301ced4273dc7919b59362cbb353cb