CVE-2010-4335 CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code
HighCVSS 7.5
EPSS 55.2%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cakephp/cakephp(Packagist) | >= 1.2.8, < 1.3.6 | 1.3.6 |
| cakefoundation cakephp | = 1.3.0 | No fix listed |
| cakephp/cakephp | = 1.2.8 | No fix listed |
| cakephp/cakephp | = 1.3-dev | No fix listed |
| cakephp/cakephp | = 1.3.0-alpha | No fix listed |
| cakephp/cakephp | = 1.3.0-beta | No fix listed |
| cakephp/cakephp | = 1.3.0-rc1 | No fix listed |
| cakephp/cakephp | = 1.3.0-rc2 | No fix listed |
| cakephp/cakephp | = 1.3.0-rc3 | No fix listed |
| cakephp/cakephp | = 1.3.0-rc4 | No fix listed |
| cakephp/cakephp | = 1.3.1 | No fix listed |
| cakephp/cakephp | = 1.3.2 | No fix listed |
| cakephp/cakephp | = 1.3.3 | No fix listed |
| cakephp/cakephp | = 1.3.4 | No fix listed |
| cakephp/cakephp | = 1.3.5 | No fix listed |
| debian/cakephp(Debian:11) | < 1.3.2-1.1 | 1.3.2-1.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- malloc.im exploit
- packetstormsecurity.org exploit
- 42211 third-party-advisory vendor-advisory
- 8026 third-party-advisory
- 16011 exploit
- 69352 vdb-entry
- github.com
- security-tracker.debian.org vendor-advisory