CVE-2020-5203 Fat-Free Framework arbitrary code execution
Attackers can execute arbitrary code if developers pass user-controlled input to the framework's Clear method.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-5203?
CVE-2020-5203 is a critical code injection vulnerability in n/a, published on 11 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
Which versions are affected by CVE-2020-5203?
2 open source packages ship an affected version, including bcosca/fatfree. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bcosca/fatfree Packagist | All versions | 3.7.2 |
bcosca/fatfree Packagist | All versions | 3.7.2 |
Products include Fatfreeframework Fat-Free Framework.
How do I fix CVE-2020-5203?
Upgrade bcosca/fatfree to 3.7.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-5203 being exploited?
There is no known exploitation of CVE-2020-5203 in the wild and no public exploit code.
Sources
Also known as GHSA-hpj2-4hfj-g233.