Description
CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download functionality with a specially crafted request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CraftCMS | CraftCMS | 1.0.0 | — |
References
- ExploitDB-48492 exploit
- Official CraftCMS Vendor Homepage product
- CraftCMS vCard Plugin Page product
- Researcher Exploit Disclosure technical-description exploit
- VulnCheck Advisory: CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution third-party-advisory