CVE-2012-5223
01.10.2012, 20:55
The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char_repl parameter, which is inserted into a regular expression that is processed by the preg_replace function with the eval switch.
| Vendor | Product | Version |
|---|---|---|
| crawlability | vbseo | 𝑥 ≤ 3.6.0 |
| crawlability | vbseo | 2.0.0 |
| crawlability | vbseo | 2.1.0 |
| crawlability | vbseo | 2.1.1 |
| crawlability | vbseo | 2.2.0 |
| crawlability | vbseo | 2.3.0 |
| crawlability | vbseo | 2.4.0 |
| crawlability | vbseo | 2.4.5 |
| crawlability | vbseo | 3.0.0 |
| crawlability | vbseo | 3.0.0:rc2 |
| crawlability | vbseo | 3.0.0:rc3 |
| crawlability | vbseo | 3.0.0:rc4 |
| crawlability | vbseo | 3.0.0:rc5 |
| crawlability | vbseo | 3.0.0:rc6 |
| crawlability | vbseo | 3.1.0 |
| crawlability | vbseo | 3.2.0 |
| crawlability | vbseo | 3.2.0:rc4 |
| crawlability | vbseo | 3.2.0:rc5 |
| crawlability | vbseo | 3.2.0:rc7 |
| crawlability | vbseo | 3.2.0:rc8 |
| crawlability | vbseo | 3.3.0 |
| crawlability | vbseo | 3.3.0:rc1 |
| crawlability | vbseo | 3.3.0:rc2 |
| crawlability | vbseo | 3.3.1 |
| crawlability | vbseo | 3.5.0 |
| crawlability | vbseo | 3.5.0:beta1 |
| crawlability | vbseo | 3.5.0:beta2 |
| crawlability | vbseo | 3.5.0:rc1 |
| crawlability | vbseo | 3.5.0:rc2 |
| crawlability | vbseo | 3.5.0:rc3 |
| crawlability | vbseo | 3.5.1 |
| crawlability | vbseo | 3.5.2 |
| crawlability | vbseo | 3.6.0:beta1 |
| crawlability | vbseo | 3.6.0:rc1 |
| crawlability | vbseo | 3.6.0:rc2 |
𝑥
= Vulnerable software versions
References