cve/2023/CVE-2023-26750.md

CVE-2023-26750

Description

** DISPUTED ** SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework.

POC

Reference

• https://github.com/yiisoft/yii2/issues/19755
• https://github.com/yiisoft/yii2/issues/19755#issuecomment-1426155955
• https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505390813
• https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505560351

Github

No PoCs found on GitHub currently.