0day.today - La plus grande base de données de Exploit dans le monde.
![](/img/logo_green.jpg)
Nous utilisons un domaine DOMAIN_LINK
Si vous voulez acheter un exploit ou payer un service vous avez besoins d'Or. Nous ne voulons pas que notre site soit utiliser comme outil de piratage , de sorte que touts types d'actions qui pourrais affecter illegalement d'autres utilisateurs ou sites web ou vous n'avez pas l'autorisation vous serez bannit et votre compte ainsi que vos donnees seront supprimees.
Les administrateur de 0day.today utilises des moyens de contacts officiels. Mefiez-vous des imposteurs!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Lire le [ J'accepte ]
- Lire le [ Envoyer ] Regles
- Visiter le [ faq ] page
- [ Enregistrement ] profil
- Obtenir [ GOLD ]
- Si vous voulez [ vendre ]
- Si vous voulez [ acheter ]
- Si vous vous perdez [ Compte ]
- Une questions [ [email protected] ]
- Connexion
- Page d'enregistrement
- Restauration de compte
- Foire aux questions
- Contactez-nous
- Regle de publication
- Page de contrat
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Vous pouvez nous contacter par:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Tuleap 7.6-4 PHP Object Injection Vulnerability
Auteur
Risque
![](/img/risk/critlow_3.gif)
Security Risk High
]0day-ID
Catégorie
Date d'ajout
CVE
Plateforme
----------------------------------------------------------------- Tuleap <= 7.6-4 (register.php) PHP Object Injection Vulnerability ----------------------------------------------------------------- [-] Software Links: https://www.tuleap.org/ https://www.enalean.com/ [-] Affected Versions: Version 7.6-4 and prior versions. [-] Vulnerability Description: The vulnerable code is located in the /src/www/project/register.php script: 27. $request = HTTPRequest::instance(); 28. 29. if (Config::get('sys_create_project_in_one_step')) { 30. $router = new Project_OneStepCreation_OneStepCreationRouter( 31. ProjectManager::instance(), 32. new Project_CustomDescription_CustomDescriptionFactory(new Project_CustomDescription ... 33. ); 34. $router->route($request); 35. exit; 36. } 37. 38. $current_step = $request->exist('current_step') ? $request->get('current_step') : 0; 39. $data = $request->exist('data') ? unserialize($request->get('data')) : array(); User input passed through the "data" request parameter is not properly sanitized before being used in a call to the "unserialize()" function at line 39. This can be exploited to inject arbitrary PHP objects into the application scope, and could allow authenticated attackers to execute arbitrary PHP code via specially crafted serialized objects, leveraging the destructor method from the Jabbex class. Successful exploitation of this vulnerability requires the "sys_create_project_in_one_step" option to be disabled. [-] Solution: Update to version 7.7 or later. [-] Disclosure Timeline: [04/11/2014] - Vendor notified [05/11/2014] - Vendor acknowledgement [10/11/2014] - Vendor fixed the issue [11/10/2014] - CVE number requested [13/11/2014] - CVE number assigned [13/11/2014] - Version 7.7 released [27/11/2014] - Public disclosure [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-8791 to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. # 0day.today [2024-07-02] #