CVE-2015-5243 phpWhois arbitrary code execution via a crafted whois record
CriticalCVSS 9.8
EPSS 6.2%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jsmitty12/phpwhois(Packagist) | < 5.1.0 | 5.1.0 |
| jsmitty12/phpwhois(Packagist) | = 4.2.3 | No fix listed |
| jsmitty12/phpwhois(Packagist) | = 4.2.4 | No fix listed |
| jsmitty12/phpwhois(Packagist) | = v4.2.5 | No fix listed |
| jsmitty12/phpwhois(Packagist) | = v5.0 | No fix listed |
| jsmitty12/phpwhois(Packagist) | = v5.0.1 | No fix listed |
| jsmitty12/phpwhois(Packagist) | = v5.0.2 | No fix listed |
| phpwhois/phpwhois(Packagist) | <= 4.2.5 | No fix listed |
| phpwhois/phpwhois(Packagist) | = 4.2.3 | No fix listed |
| phpwhois/phpwhois(Packagist) | = 4.2.4 | No fix listed |
| phpwhois/phpwhois(Packagist) | = v4.2.5 | No fix listed |
| brightlocal/phpwhois(Packagist) | <= 4.2.5 | No fix listed |
| brightlocal/phpwhois(Packagist) | = 4.2.3 | No fix listed |
| brightlocal/phpwhois(Packagist) | = 4.2.4 | No fix listed |
| brightlocal/phpwhois(Packagist) | = v4.2.5 | No fix listed |
| david-garcia/phpwhois(Packagist) | <= 4.3.1 | No fix listed |
| david-garcia/phpwhois(Packagist) | = 4.2.3 | No fix listed |
| david-garcia/phpwhois(Packagist) | = 4.2.4 | No fix listed |
| david-garcia/phpwhois(Packagist) | = 4.3.0 | No fix listed |
| david-garcia/phpwhois(Packagist) | = 4.3.1 | No fix listed |
| david-garcia/phpwhois(Packagist) | = v4.2.5 | No fix listed |
| ivankristianto/phpwhois(Packagist) | <= 4.3.0 | No fix listed |
| ivankristianto/phpwhois(Packagist) | = 4.2.3 | No fix listed |
| ivankristianto/phpwhois(Packagist) | = 4.2.4 | No fix listed |
| ivankristianto/phpwhois(Packagist) | = v4.2.5 | No fix listed |
Show 21 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ivankristianto/phpwhois(Packagist) | = v4.2.6 | No fix listed |
| ivankristianto/phpwhois(Packagist) | = v4.3.0 | No fix listed |
| kazist/phpwhois(Packagist) | <= 4.2.6 | No fix listed |
| kazist/phpwhois(Packagist) | = 4.2.3 | No fix listed |
| kazist/phpwhois(Packagist) | = 4.2.4 | No fix listed |
| kazist/phpwhois(Packagist) | = v4.2.5 | No fix listed |
| kazist/phpwhois(Packagist) | = v4.2.6 | No fix listed |
| serluck/phpwhois(Packagist) | <= 4.2.6 | No fix listed |
| serluck/phpwhois(Packagist) | = 4.2.3 | No fix listed |
| serluck/phpwhois(Packagist) | = 4.2.4 | No fix listed |
| serluck/phpwhois(Packagist) | = v4.2.5 | No fix listed |
| serluck/phpwhois(Packagist) | = v4.2.6 | No fix listed |
| simple-updates/phpwhois(Packagist) | <= 1.0.0 | No fix listed |
| simple-updates/phpwhois(Packagist) | = 1.0.0 | No fix listed |
| truckersmp/phpwhois(Packagist) | <= 4.3.1 | No fix listed |
| truckersmp/phpwhois(Packagist) | = 4.2.3 | No fix listed |
| truckersmp/phpwhois(Packagist) | = 4.2.4 | No fix listed |
| truckersmp/phpwhois(Packagist) | = v4.2.5 | No fix listed |
| truckersmp/phpwhois(Packagist) | = v4.3.0 | No fix listed |
| truckersmp/phpwhois(Packagist) | = v4.3.1 | No fix listed |
| phpwhois project phpwhois | <= 4.2.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com patch third-party-advisory
- github.com patch vendor-advisory
- blog.nettitude.com third-party-advisory
- github.com exploit
- github.com exploit
- github.com exploit
- github.com exploit
- github.com exploit
- github.com exploit
- github.com exploit
- github.com exploit
- github.com release-notes third-party-advisory
- github.com exploit third-party-advisory
- github.com