CVE-2015-2945: Code Injection
Published May 25, 2015
·Updated
mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015.
Affected Software
1 affected component
H-fj Mt-phpincgi
Event History
May 25, 2015
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-2945?
CVE-2015-2945 has a high severity due to its potential for remote code execution via PHP object injection.
2
How do I fix CVE-2015-2945?
To fix CVE-2015-2945, upgrade to a version of mt-phpincgi released after May 15, 2015.
3
What type of attack can be executed using CVE-2015-2945?
CVE-2015-2945 allows remote attackers to conduct PHP object injection attacks.
4
Which software is affected by CVE-2015-2945?
CVE-2015-2945 affects Hajime Fujimoto mt-phpincgi software versions prior to May 15, 2015.
5
What is the impact of exploiting CVE-2015-2945?
Exploiting CVE-2015-2945 can allow an attacker to execute arbitrary PHP code on the affected system.