CVE-2012-5223 The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly....
HighCVSS 7.5
EPSS 40.5%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char_repl parameter, which is inserted into a regular expression that is processed by the preg_replace function with the eval switch.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| crawlability vbseo | <= 3.6.0 | No fix listed |
| crawlability vbseo | = 2.0.0 | No fix listed |
| crawlability vbseo | = 2.1.0 | No fix listed |
| crawlability vbseo | = 2.1.1 | No fix listed |
| crawlability vbseo | = 2.2.0 | No fix listed |
| crawlability vbseo | = 2.3.0 | No fix listed |
| crawlability vbseo | = 2.4.0 | No fix listed |
| crawlability vbseo | = 2.4.5 | No fix listed |
| crawlability vbseo | = 3.0.0 | No fix listed |
| crawlability vbseo | = 3.0.0-rc2 | No fix listed |
| crawlability vbseo | = 3.0.0-rc3 | No fix listed |
| crawlability vbseo | = 3.0.0-rc4 | No fix listed |
| crawlability vbseo | = 3.0.0-rc5 | No fix listed |
| crawlability vbseo | = 3.0.0-rc6 | No fix listed |
| crawlability vbseo | = 3.1.0 | No fix listed |
| crawlability vbseo | = 3.2.0 | No fix listed |
| crawlability vbseo | = 3.2.0-rc4 | No fix listed |
| crawlability vbseo | = 3.2.0-rc5 | No fix listed |
| crawlability vbseo | = 3.2.0-rc7 | No fix listed |
| crawlability vbseo | = 3.2.0-rc8 | No fix listed |
| crawlability vbseo | = 3.3.0 | No fix listed |
| crawlability vbseo | = 3.3.0-rc1 | No fix listed |
| crawlability vbseo | = 3.3.0-rc2 | No fix listed |
| crawlability vbseo | = 3.3.1 | No fix listed |
| crawlability vbseo | = 3.5.0 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| crawlability vbseo | = 3.5.0-beta1 | No fix listed |
| crawlability vbseo | = 3.5.0-beta2 | No fix listed |
| crawlability vbseo | = 3.5.0-rc1 | No fix listed |
| crawlability vbseo | = 3.5.0-rc2 | No fix listed |
| crawlability vbseo | = 3.5.0-rc3 | No fix listed |
| crawlability vbseo | = 3.5.1 | No fix listed |
| crawlability vbseo | = 3.5.2 | No fix listed |
| crawlability vbseo | = 3.6.0-beta1 | No fix listed |
| crawlability vbseo | = 3.6.0-rc1 | No fix listed |
| crawlability vbseo | = 3.6.0-rc2 | No fix listed |
References
- 78508 vdb-entry
- 47699 third-party-advisory vendor-advisory
- 18424 exploit
- 51647 vdb-entry
- www.vbseo.com exploit patch vendor-advisory
- vbseo-procdeutf-code-execution(72689) vdb-entry