medium6.5Public exploit code
CVE-2014-5194
Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php v…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Sphider Search Engine 1.3.6 - Multiple Vulnerabilities2014-07-28 · webapps · php · Verified
Impact
Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the _word_upper_bound parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sphider | Sphider | Version 1.3.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/159715/Sphider-Search-Engine-1.3.6-Remote-Code-Execution.html
- http://www.exploit-db.com/exploits/34189
- http://packetstormsecurity.com/files/159715/Sphider-Search-Engine-1.3.6-Remote-Code-Execution.html
- http://www.exploit-db.com/exploits/34189