News

SBA Security Advisory – phpWhois – PHP Code Injection (CVE-2015-5243)

Vulnerability Overview

phpWhois and some of its forks in versions before 5.1.0 are prone to a code injection vulnerability due to insufficient sanitization of returned WHOIS data. This allows attackers controlling the WHOIS information of a requested domain to execute arbitrary PHP code in the context of the application.

• Type of Vulnerability: Code Injection
• Fixed in Version: jsmitty12: 5.1.0
• CVE ID: CVE-2015-5243
• CVSSv3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• CVSSv3 Base Score: 9.8 (Critical)

Recommended Countermeasure

We recommend to update phpWhois to version jsmitty12: 5.1.0 or later. For further details, see the full security advisory.

Links

Full Security Advisory

Credits

• Original advisory by Iain Wallace (Nettitude)
• Rediscovered by David Lisa Gnedt (SBA Research)