CVE-2015-2171

Slim < 2.6.0 - Remote Code Execution via Session Cookie Deserialization

Title source: llm

Description

Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/70087

Issue Tracking x_refsource_confirm

https://github.com/slimphp/Slim/issues/1034

Vendor Advisory x_refsource_confirm

http://www.slimframework.com/2015/03/01/version-260.html

Mailing List mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2015/Mar/16

Scores

EPSS 0.0251

EPSS Percentile 82.8%

Details

CWE

CWE-94

Status published

Products (2)

slim/slim 0 - 2.6.0Packagist

slimframework/slim < 2.5.0

Published Mar 30, 2015

Tracked Since Feb 18, 2026