CVE-2023-47130— Unsafe deserialization of user data in yiisoft/yii
Quick assessment
Affected
yiisoft yii
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Yii是YII团队的开发的一套基于组件、用于开发大型Web应用的高性能PHP框架。 Yii 1.1.29之前版本存在安全漏洞，该漏洞源于容易受到远程代码执行(RCE)攻击，攻击者可能会利用此漏洞来危害主机系统。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-47130
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unsafe deserialization of user data in yiisoft/yii
Source: CVE Program / CVE List V5
Vulnerability Description
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Yii 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Yii是YII团队的开发的一套基于组件、用于开发大型Web应用的高性能PHP框架。 Yii 1.1.29之前版本存在安全漏洞，该漏洞源于容易受到远程代码执行(RCE)攻击，攻击者可能会利用此漏洞来危害主机系统。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-47130
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 11282 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2023-47130
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-47130 (1)
Vendor Advisories for CVE-2023-47130 (1)
-
https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8q x_refsource_CONFIRM
News Coverage for CVE-2023-47130 (1)
IV. Related Vulnerabilities
Same vendor: yiisoft
-
CVE-2026-39850
Yii 2: Local file inclusion via view parameter name collisio -
CVE-2025-48493
Yii 2 Redis may expose AUTH paramters in logs in case of con -
CVE-2025-32027
Yii does not prevent XSS in scenarios where fallback error r -
CVE-2025-2690
yiisoft Yii2 MockClass.php generate deserialization -
CVE-2025-2689
yiisoft Yii2 SortableIterator.php getIterator deserializatio
Same weakness: CWE-502
-
CVE-2026-103877
Apache Directory LDAP API: Unsafe loading of Java code from -
CVE-2026-55083
DHIS2: Unsafe Java Deserialization - Remote Code Execution ( -
CVE-2026-12544
Foreman: ssti and insecure deserialization in foreman-rake c -
CVE-2026-97284
WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vu -
CVE-2026-94390
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5
V. Comments for CVE-2023-47130
No comments yet