high7.5Public exploit code
CVE-2010-4335
The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal C…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CakePHP 1.3.5/1.2.8 - Cache Corruption (Metasploit)2011-01-14 · webapps · php · Verified
- CakePHP 1.3.5/1.2.8 - 'Unserialize()' File Inclusion2011-01-18 · webapps · php
Impact
The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cakefoundation | Cakephp | Version 1.3.0 |
| Cakephp | Cakephp | Versions 1.2.8, 1.3, 1.3.0, 1.3.1, 1.3.2, 1.3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://malloc.im/CakePHP-unserialize.txt
- http://packetstormsecurity.org/files/view/95847/burnedcake.py.txt
- http://secunia.com/advisories/42211
- http://securityreason.com/securityalert/8026
- http://www.exploit-db.com/exploits/16011
- http://www.osvdb.org/69352
- https://github.com/cakephp/cakephp/commit/e431e86aa4301ced4273dc7919b59362cbb353cb
- http://malloc.im/CakePHP-unserialize.txt
- http://packetstormsecurity.org/files/view/95847/burnedcake.py.txt
- http://secunia.com/advisories/42211
- http://securityreason.com/securityalert/8026
- http://www.exploit-db.com/exploits/16011
- http://www.osvdb.org/69352
- https://github.com/cakephp/cakephp/commit/e431e86aa4301ced4273dc7919b59362cbb353cb