CVE-2024-58136 PoC — Yii 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-58136.yaml

Associated Vulnerability

Title:Yii 安全漏洞 (CVE-2024-58136)
Description:Yii是YII团队的开发的一套基于组件、用于开发大型Web应用的高性能PHP框架。 Yii 2 2.0.52之前版本存在安全漏洞，该漏洞源于行为附加处理不当。

Description

Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the __class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE.

File Snapshot


 id: CVE-2024-58136

info:
  name: Yii2 PHP Framework < 2.0.52 - Remote Code Execution
  author: riti

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.