CyberRota Analysis
AI-GeneratedThe Yii2 starter kit versions up to 4.2.0 are vulnerable due to the default configuration allowing unrestricted access to the Yii debug and Gii modules from any IP address. This exposure enables unauthenticated remote attackers to exploit these endpoints, potentially accessing sensitive information such as session cookies and database queries, or generating malicious PHP files within the application directory. Organizations using this framework should prioritize immediate remediation to mitigate the risk of data breaches and unauthorized code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.