CVE-2016-6175

CRITICAL

php-gettext <1.0.12 - Code Injection

Title source: llm

Description

Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.

Exploits (1)

exploitdb WORKING POC VERIFIED

by kmkz · textwebappsphp

https://www.exploit-db.com/exploits/40154

View Code ZIP pw:eip

References (4)

[Issue Tracking] https://bugs.launchpad.net/php-gettext/+bug/1606184

[Various Sources] https://kmkz-web-blog.blogspot.cz/2016/07/advisory-cve-2016-6175.html

[Patch] https://github.com/NagVis/nagvis/commit/4fe8672a5aec3467da72b5852ca6d283c15adb53

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/40154/

Scores

CVSS v3 9.8

EPSS 0.1093

EPSS Percentile 93.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-94

Status published

Products (1)

php-gettext_project/php-gettext < 1.0.12

Published Feb 07, 2017

Tracked Since Feb 18, 2026