Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 3 Feb 2014 10:54:54 +0000
From: Pedro Ribeiro <>
Cc: Leo Feyer <>, Andreas Schempp <>
Subject: CVE request: PHP object insertion in Contao CMS <= 3.2.5


I have discovered a vulnerability that might lead to code execution in
Contao CMS <= 3.2.4
Contao CMS <= 3.2.4 does not properly validate user input in several
locations which is then passed directly into PHP's unserialize.

This has been fixed in Contao 2.3.5 as per commit:

Announcements can be found at

https <>://<> <>/<>
en <>/news/<>
contao <>-3_2_5.<>
html <>

https <>://<> <>/<>
en <>/news/<>
contao <>-2_11_14.<>
html <>

Thanks to the Contao developers for being so responsive.
The full report can be found at my repo in

Can you please assign a CVE for the vulnerability described above?

Thanks in advance.


Pedro Ribeiro
Agile Information Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.