CyberRota Analysis
AI-GeneratedCraft CMS versions prior to 5.10.12 are vulnerable due to inadequate cleansing of string-typed field-layout elements, enabling authenticated users to inject malicious Yii2 behavior attachments and event handlers. This flaw allows attackers to bypass validation and execute arbitrary code through object instantiation, posing a significant risk to the integrity of the application. Organizations using affected versions should prioritize remediation to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().