CVE-2014-5194 - Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the _word_upper_bound parameter

Back Back to CVE browser

MEDIUM

Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the _word_upper_bound parameter

Published Aug 7, 2014

6.5

MEDIUM

CVSS 2.0

EPSS 4.21%

Description

Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the _word_upper_bound parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (2)

http://packetstormsecurity.com/files/159715/Sphider-Search-Engine-1.3.6-Remote-Code-Execution.html
x_refsource_MISC
http://www.exploit-db.com/exploits/34189
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
http://packetstormsecurity.com/files/159715/Sphider-Search-Engine-1.3.6-Remote-Code-Execution.html		x_refsource_MISC
http://www.exploit-db.com/exploits/34189		exploitx_refsource_EXPLOIT-DB

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 7, 2014

Updated Aug 6, 2024

Reserved Aug 7, 2014

Link CVE-2014-5194

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2014-5194

Red Hat

Severity n/a

Public date n/a

Links CVE-2014-5194