JVNDB-2015-000067

mt-phpincgi vulnerable to PHP object injection

mt-phpincgi is script that runs Movable Type templates as PHP. mt-phpincgi contains a PHP object Injection vulnerability.

According to the reporter, attacks that attempt to exploit this vulnerability have been confirmed.

Ichi Fujimoto

• mt-phpincgi

This vulnerability has been addressed in mt-phpincgi.php security update (in Japanese) released on 2015/05/15.

Arbitrary PHP code may be executed on the server by an unauthenticated attacker.

[Apply the update]
The developer has released an update at mt-phpincgi.php security update.
Apply the update according to the information provided by the developer.

Ichi Fujimoto

• The blog of H.Fujimoto : Hajime Fujimoto website (in Japanese)
• The blog of H.Fujimoto : mt-phpincgi.php security update (in Japanese)

1. Code Injection(CWE-94) [IPA Evaluation]

1. CVE-2015-2945

1. JVN : JVN#64459670
2. National Vulnerability Database (NVD) : CVE-2015-2945
3. IPA SECURITY ALERTS : Security Alert for Vulnerability in mt-phpincgi (JVN#64459670) (in Japanese)

• [2015/05/20]
    Web page was published
  [2015/05/25]
    Solution was modified
  [2015/05/28]
    References : Content was added