CVE-2023-26750

CVSS V2 None CVSS V3 None

Description

** DISPUTED ** SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework.

Overview

CVE ID
CVE-2023-26750

Assigner
cve@mitre.org

Vulnerability Status
Modified

Published Version
2023-04-04T15:15:08

Last Modified Date
2023-04-14T20:15:09

Weakness Enumerations

CWE	URL
CWE-89	http://cwe.mitre.org/data/definitions/89.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version Start	Version End
cpe:2.3:a:yiiframework:yii::::::::	1	OR	2.0.0	2.0.47

References

Reference URL	Reference Tags
https://github.com/yiisoft/yii2/issues/19755	Exploit Issue Tracking
https://github.com/yiisoft/yii2/issues/19755#issuecomment-1426155955
https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505390813
https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505560351

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-26750
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26750

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 04:06:38				Added to TrackCVE
2023-04-17 04:06:41			Weakness Enumeration	new