SBA Security Advisory – phpWhois – PHP Code Injection (CVE-2015-5243)
Vulnerability Overview
phpWhois and some of its forks in versions before 5.1.0 are prone to a code injection vulnerability due to insufficient sanitization of returned WHOIS data. This allows attackers controlling the WHOIS information of a requested domain to execute arbitrary PHP code in the context of the application.
- Type of Vulnerability: Code Injection
- Fixed in Version: jsmitty12: 5.1.0
- CVE ID: CVE-2015-5243
- CVSSv3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSSv3 Base Score: 9.8 (Critical)
Recommended Countermeasure
We recommend to update phpWhois to version jsmitty12: 5.1.0 or later. For further details, see the full security advisory.
Links
Credits
- Original advisory by Iain Wallace (Nettitude)
- Rediscovered by David Lisa Gnedt (SBA Research)