CVE-2020-12469: Subrion CMS PHP Object Injection
Summary
CVE-2020-12469: Subrion CMS PHP Object Injection. Affects intelliants/subrion versions < 4.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subrion CMS is an open-source content management system that allows users to create and manage websites. It provides various features such as user management, content editing, and plugin support. However, Subrion CMS versions up to 4.2.1 are vulnerable to PHP Object Injection, which can lead to file deletion. This vulnerability exists in the 'admin/blocks.php' file, specifically in the handling of serialized data in the 'subpages' value within a block during the editing process.
Vulnerability Detail
The PHP Object Injection vulnerability in Subrion CMS allows an attacker to inject malicious serialized data into the 'subpages' value of a block. When this data is deserialized, it can lead to the execution of arbitrary code or the deletion of files on the server. An attacker with access to the CMS can exploit this vulnerability to compromise the integrity and availability of the system. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating to the latest version is not immediately possible, a temporary workaround is to disable the 'blocks' functionality within the CMS. This can be achieved by modifying the configuration or permissions to prevent users from accessing the 'admin/blocks.php' file. By disabling this feature, the risk of exploitation through PHP Object Injection can be mitigated.
Conclusion
The PHP Object Injection vulnerability in Subrion CMS versions up to 4.2.1 can lead to arbitrary code execution or file deletion. It is crucial to update to the latest version (4.2.2 or later) to mitigate this vulnerability. If immediate update is not possible, disabling the 'blocks' functionality can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for intelliants/subrion →
FAQ
Subrion CMS is an open-source content management system that allows users to create and manage websites. It provides various features such as user management, content editing, and plugin support.
PHP Object Injection is a vulnerability that occurs when untrusted user input is deserialized and used to create PHP objects. This can lead to the execution of arbitrary code or the manipulation of object properties.
The PHP Object Injection vulnerability in Subrion CMS can allow an attacker to execute arbitrary code or delete files on the server. This can result in unauthorized access, data loss, or disruption of the affected system.
To protect your Subrion CMS installation, it is recommended to update to the latest version (4.2.2 or later) that includes the fix for this vulnerability. Additionally, ensure that your server environment is secure and follow best practices for web application security.
Yes, if updating to the latest version is not immediately possible, you can disable the 'blocks' functionality within Subrion CMS. This can be done by modifying the configuration or permissions to prevent users from accessing the vulnerable 'admin/blocks.php' file.
Related vulnerabilities
Recent vulnerabilities recorded for intelliants/subrion.
