CVE-2014-2293

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the (1) authentication_method_ser or (2) authentication_info_ser parameter to index.php, or (3) zikulaMobileTheme parameter to index.php.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://karmainsecurity.com/KIS-2014-02Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91786Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91787Third Party Advisory, VDB Entry
https://secuniaresearch.flexerasoftware.com/secunia_research/2014-2/Third Party Advisory
http://karmainsecurity.com/KIS-2014-02Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91786Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91787Third Party Advisory, VDB Entry
https://secuniaresearch.flexerasoftware.com/secunia_research/2014-2/Third Party Advisory

Timeline

Published: Mar 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-22949.8Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the CVE-2014-22968.8XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2 CVE-2014-22976.1Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote CVE-2014-22999.3Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 all CVE-2014-23015.0OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations (op=inf) to an object in pub/bscw.cgi CVE-2014-23029.8The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection att CVE-2014-23037.5Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 CVE-2014-23047.5A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of th CVE-2014-23096.1The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allo CVE-2014-23105.0The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request w CVE-2014-23117.5SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL comman CVE-2014-23125.5The main function in android_main.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid.