CVE-2014-8081 lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter_result_result parameter.
HighCVSS 7.5
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter_result_result parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| testlink | <= 1.9.12 | No fix listed |
References
- karmainsecurity.com exploit patch
- mantis.testlink.org vendor-advisory
- 20141023 [KIS-2014-11] TestLink <= 1.9.12 (execSetResults.php) PHP Object Injection Vulnerability exploit mailing-list patch
- 20141023 [KIS-2014-11] TestLink <= 1.9.12 (execSetResults.php) PHP Object Injection Vulnerability mailing-list
- 70711 vdb-entry
- testlink-cve20148081-code-exec(97727) vdb-entry
- gitorious.org