NetSight
IP …
high7.5Public exploit code

CVE-2012-5223

The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execu…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char_repl parameter, which is inserted into a regular expression that is processed by the preg_replace function with the eval switch.

Affected products

VendorProductAffected versions
CrawlabilityVbseo
through 3.6.0
Versions 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.3.0

Weakness classification

CWE-94

References