Critical severity · published Mar 23, 2017
CVE-2014-8731
PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename,"…
9.8
CVSS
11.8%
EPSS
No
On KEV
Description
PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename," which creates a file in webroot.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)11.8% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phpmemcachedadmin · Phpmemcachedadmin Project
through 1.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8731
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8731
Third Party Advisory
http://packetstormsecurity.com/files/129089/PHPMemcachedAdmin-1.2.2-Remote-Code-Execution.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/533968/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/533980/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/71059
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/98638
More from Phpmemcachedadmin
–
CVE-2014-8732
Cross-site scripting (XSS) vulnerability in phpMemcachedAdmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors