Description
lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter_result_result parameter.
References
- 20141023 [KIS-2014-11] TestLink <= 1.9.12 (execSetResults.php) PHP Object Injection Vulnerability mailing-list
- https://gitorious.org/testlink-ga/testlink-code/commit/a519da3a45d80077e4eab957eb793b03652f57dc
- http://karmainsecurity.com/KIS-2014-11
- http://mantis.testlink.org/view.php?id=6651
- 70711 vdb-entry
- testlink-cve20148081-code-exec(97727) vdb-entry
- 20141023 [KIS-2014-11] TestLink <= 1.9.12 (execSetResults.php) PHP Object Injection Vulnerability mailing-list