Main
Vulnerability Database
Exploits
ID:4252 - Exploit for Input validation error in Zend Framework - CVE-2012-3363
ID:4252 - Exploit for Input validation error in Zend Framework - CVE-2012-3363
Published: August 11, 2020
Vulnerability identifier: #VU43093
Vulnerability risk: Medium
CVE-ID: CVE-2012-3363
CWE-ID: CWE-20
Exploitation vector: Remote access
Vulnerable software:
Zend Framework
Zend Framework
Link to public exploit:
Vulnerability description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.
Remediation
Install update from vendor's website.