-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how CDetailView processes the 'value' property in attribute configurations. The Yii security announcement explicitly links the issue to user-controlled 'value' properties being evaluated as PHP code. The evaluateExpression method (which uses create_function internally) is used to evaluate PHP expressions in widget contexts. When attackers control the 'value' input, this leads to code injection via CWE-94. The file path and method are consistent with Yii 1.1.x architecture and the described attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| yiisoft/yii | composer | >= 1.1.14, < 1.1.15 | 1.1.15 |