CVE-2015-5687
Anchor CMS PHP Object Injection
Time Line
Published
2024-03-19
Updated
2024-03-19
Firt exploit
2024-03-19
Overview
Descriptions (3)
NVD, NVD, PS
CWE (1)
CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC (-)
Risk
CVSS Score
9.8 Critical
SSVC
-
KEV
-
EPSS
0.6%
Affected Products (-)
Vendors (1)
anchorcms
Products (1)
anchor_cms
Versions (3)
0.9.1, 0.9.2, 0.9.3
Intel Resources (1)
Advisories (1)
PacketStorm
Exploits (-)
-
Plugins (-)
-
References (3)
General (3)
seclists, github
Exploits & POcs (-)
Patches (-)
Advisories (-)
Summary
Descriptions
system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie.
system/session/drivers/cookie.php en Anchor CMS 0.9.x permite a atacantes remotos llevar a cabo ataques de inyección de objetos PHP y ejecutar código PHP arbitrario a través de una cookie serializada manipulada.
Anchor CMS suffers from a PHP object injection vulnerability.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2015-07-27 CVE Reserved
- 2015-08-27 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Threat Intelligence Resources (1)
| Select | Title | Date |
|---|---|---|
| Anchor CMS PHP Object Injection | 2015-08-27 |
Security Advisory details:
Select an advisory to view details here.
| Select | Title | Date |
|---|
Select an exploit to view details here.
References (3)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/fulldisclosure/2015/Aug/76 | Mailing List |
|
| http://seclists.org/fulldisclosure/2015/Aug/83 | Mailing List |
|
| https://github.com/anchorcms/anchor-cms/pull/904 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Anchorcms Search vendor "Anchorcms" | Anchor Cms Search vendor "Anchorcms" for product "Anchor Cms" | 0.9.1 Search vendor "Anchorcms" for product "Anchor Cms" and version "0.9.1" | - |
Affected
| ||||||
| Anchorcms Search vendor "Anchorcms" | Anchor Cms Search vendor "Anchorcms" for product "Anchor Cms" | 0.9.2 Search vendor "Anchorcms" for product "Anchor Cms" and version "0.9.2" | - |
Affected
| ||||||
| Anchorcms Search vendor "Anchorcms" | Anchor Cms Search vendor "Anchorcms" for product "Anchor Cms" | 0.9.3 Search vendor "Anchorcms" for product "Anchor Cms" and version "0.9.3" | - |
Affected
| ||||||
| Anchorcms Search vendor "Anchorcms" | Anchor Cms Search vendor "Anchorcms" for product "Anchor Cms" | 0.9.3 Search vendor "Anchorcms" for product "Anchor Cms" and version "0.9.3" | alpha |
Affected
| ||||||
| Anchorcms Search vendor "Anchorcms" | Anchor Cms Search vendor "Anchorcms" for product "Anchor Cms" | 0.9.3 Search vendor "Anchorcms" for product "Anchor Cms" and version "0.9.3" | beta |
Affected
| ||||||