CVE-2014-4672: Yii PHP Framework arbitrary PHP scripts execution

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Yii PHP Framework is a high-performance PHP framework for developing web applications. It provides a set of tools and features to simplify the development process and enhance security. The framework includes various components, such as CDetailView, which is a widget used to display details of a model in a tabular format. However, in version 1.1.14 of Yii PHP Framework, there is a vulnerability that allows remote attackers to execute arbitrary PHP scripts by exploiting vectors related to the value property of the CDetailView widget.

Vulnerability Detail

The vulnerability in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts. By manipulating the value property of the CDetailView widget, an attacker can inject malicious PHP code that will be executed on the server. This can lead to unauthorized access, data leakage, and potential compromise of the entire system. The vulnerability is classified as CWE-94, which refers to code injection attacks.

composer require yiisoft/yii:1.1.15

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing the input values passed to the CDetailView widget. This can be done by implementing custom input filtering and validation functions to ensure that only safe and expected values are processed. Here is an example of how to implement input validation for the value property:

// Custom input validation function
function validateInput($input) {
  // Perform input validation logic here
  // Return sanitized input or false if validation fails
}

// Usage in CDetailView widget
$widget->value = validateInput($_POST['value']);

By implementing this workaround, the risk of arbitrary PHP script execution can be reduced until the framework is updated to a secure version.

Conclusion

In conclusion, the Yii PHP Framework version 1.1.14 is vulnerable to arbitrary PHP script execution. To mitigate this vulnerability, it is recommended to upgrade to version 1.1.15 or later. If immediate upgrade is not possible, implementing a temporary workaround by validating and sanitizing input values can reduce the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for yiisoft/yii →

FAQ