CVE-2021-25294

Опубликовано: 18 янв. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Средний

Описание

OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an __destruct magic method in guzzlehttp.

Ссылки

https://github.com/snoopysecurity/snoopysecurity.github.io/blob/master/web-application-security/2021/01/16/09_opencats_php_object_injection.html
Patch
Third Party Advisory
https://snoopysecurity.github.io/web-application-security/2021/01/16/09_opencats_php_object_injection.html
Exploit
Third Party Advisory
https://www.opencats.org/news/
Vendor Advisory
https://github.com/snoopysecurity/snoopysecurity.github.io/blob/master/web-application-security/2021/01/16/09_opencats_php_object_injection.html
Patch
Third Party Advisory
https://snoopysecurity.github.io/web-application-security/2021/01/16/09_opencats_php_object_injection.html
Exploit
Third Party Advisory
https://www.opencats.org/news/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:opencats:opencats:*:*:*:*:*:*:*:*

Версия до 0.9.5-3 (включая)

EPSS

Процентиль: 96%

0.27726

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-wvm3-h9rx-qj3q

github

больше 3 лет назад