NetSight
IP …
high7.5Public exploit code

CVE-2014-1691

The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and exe…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.

Affected products

VendorProductAffected versions
HordeHorde Application Framework
through 5.1.0
Versions 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4

Weakness classification

CWE-94

References