vendor:
phpFox
by:
Egidio Romano aka EgiX
6.1
CVSS
HIGH
PHP Object Injection
915
CWE
Product Name: phpFox
Affected Version From: <= 4.8.13
Affected Version To: 4.8.13
Patch Exists: NO
Related CWE:
CPE: a:phpfox:phpfox:4.8.13
Platforms Tested:
2023
phpFox <= 4.8.13 (redirect) PHP Object Injection Vulnerability
The vulnerability in phpFox <= 4.8.13 allows remote attackers to inject arbitrary PHP objects by passing user input through the 'url' request parameter to the /core/redirect route without proper sanitization. This can lead to various attacks, including executing arbitrary PHP code.
Mitigation:
To mitigate this vulnerability, it is recommended to sanitize and validate user input before using it in unserialize() or similar PHP functions. Additionally, keeping the software up to date with the latest security patches is crucial.
