CVE-2014-8684

EPSS 71.5%

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2

cve_referencepacketstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.htmlno verificado exploitdbwww.exploit-db.com/exploits/36264no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html http://seclists.org/fulldisclosure/2014/May/54 https://github.com/kohana/core/pull/492 https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection