CVE-2014-2922
pimcore 1.4.9-2.1.0 - PHP Object Injection and Arbitrary File Deletion via Newsletter Token Deserialization
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-2922. PoCs published by Pedro Ribeiro.
AI-analyzed exploit summary The exploit demonstrates a PHP object injection vulnerability in Pimcore CMS via the `unserialize()` function in the newsletter unsubscribe page. It includes two payloads: one for remote code execution (RCE) on PHP <= 5.3.3 and another for arbitrary file deletion on any PHP version.
Description
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.
Exploits (1)
The exploit demonstrates a PHP object injection vulnerability in Pimcore CMS via the `unserialize()` function in the newsletter unsubscribe page. It includes two payloads: one for remote code execution (RCE) on PHP <= 5.3.3 and another for arbitrary file deletion on any PHP version.