CVE-2015-2945

mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015.

Score

CVSS 2.0 7.5 High

Status

Modified - vultures@jpcert.or.jp

Published

2015-05-25

Last modified

2024-08-06

Weaknesses

CWE-94

Affected products

• Mt-phpincgi (H-fj)

References

• http://jvn.jp/en/jp/JVN64459670/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000067
• http://www.h-fj.com/blog/archives/2015/05/15-112843.php