Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-1999: FuelPHP Request_Curl auto‑format can run malicious code

CVE-2014-1999 · published 12 years ago

Summary

FuelPHP versions 1.1 to 1.7.1 have a feature that automatically formats data received from other servers. An attacker can send a specially crafted response that tricks this feature into executing unwanted code on your server. Upgrade to a newer FuelPHP release or apply the provided security patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
fuelphp	fuelphp	1.1 1.2 1.2.1 1.3 1.4 1.5 1.5.1 1.5.2 1.5.3 1.6 1.6.1 1.7 1 more version range `cpe:2.3:a:fuelphp:fuelphp:1.1:::::::*`

Original advisory text

The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response.

References

http://fuelphp.com/security-advisories Vendor Advisory
http://jvn.jp/en/jp/JVN94791545/index.html Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000082 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

3% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published20 Jul 2014

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2014-1999 · NVD

Track software like this

Free during beta