CVE-2014-125107 Corveda PHPSandbox String protection mechanism
Attackers can bypass the string protection mechanism in Corveda PHPSandbox, potentially executing restricted code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-125107?
CVE-2014-125107 is a medium-severity vulnerability in Corveda PHPSandbox, published on 19 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in Corveda PHPSandbox 1.3.4 and classified as critical. Affected by this issue is some unknown functionality of the component String Handler. The manipulation leads to protection mechanism failure. The attack may be launched remotely. Upgrading to version 1.3.5 is able to address this issue. The patch is identified as 48fde5ffa4d76014bad260a3cbab7ada3744a4cc. It is recommended to upgrade the affected component. VDB-248270 is the identifier assigned to this vulnerability.
Weakness: CWE-693
Which versions are affected by CVE-2014-125107?
2 open source packages ship an affected version, including corveda/phpsandbox. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
corveda/phpsandbox Packagist | All versions | 1.3.5 |
corveda/phpsandbox Packagist | All versions | 1.3.5 |
Products include Corveda Phpsandbox.
How do I fix CVE-2014-125107?
Upgrade corveda/phpsandbox to 1.3.5 or later.
Is CVE-2014-125107 being exploited?
There is no known exploitation of CVE-2014-125107 in the wild and no public exploit code.
Sources
Also known as GHSA-625p-jwcp-r2r5.