GHSA-74mf-vjpg-9xh7

Slim vulnerable to PHP object injection

Source: GitHub Advisory Database (reviewed) High CVE-2015-2171

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	slim/slim	< 2.6.0	2.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-2171 advisory
https://github.com/slimphp/Slim/issues/1034 web
https://github.com/slimphp/Slim/commit/9fa651474eb4d3bb0ce40dd5a55c51bb861c2658 web
https://github.com/FriendsOfPHP/security-advisories/blob/master/slim/slim/CVE-2015-2171.yaml web
https://github.com/slimphp/Slim package
https://web.archive.org/web/20200229032229/http://www.securityfocus.com/bid/70087 web
http://seclists.org/fulldisclosure/2015/Mar/16 web
http://www.slimframework.com/2015/03/01/version-260.html web