The CDetailView widget allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property

More info at https://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/...

Yii Framework Blog Cross Site Request Forgery

Exploit Title: Yii Framework Blog Application CSRF Vulnerability Date: 3 Mar 2014 Author: Christy Philip Mathew Demo: Yii Blog Application - http://www.yiiframework.com/demos/blog/ Category:: web Tested on: Windows 8 Attacker will be able to create a post...

Yii Framework 'Search'表单字段SQL注入漏洞

BUGTRAQ ID: 56620 Yii Framework是一个基于组件、用于开发大型Web应用的高性能PHP框架。 Yii Framework 1.1.8及其他版本存在SQL注入漏洞，成功利用后可允许攻击者控制应用、访问或修改数据、利用下层数据库内的其他潜在漏洞。 0 Yii Framework 1.1.8 厂商补丁： yiiframework ------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.yiiframework.com/...

Yii Framework 1.1.8 Search SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Yii Framework - Search SQL Injection Vulnerability Google Dork: No Dork Date: 20/11/2012 Exploit Author: Junookyo Vendor Homepage: http://www.yiiframework.com/ Software Link: http://www.yiiframework.com/download/ Version: 1.1.8...

Yii Framework 1.1.8 Search SQL Injection

Exploit Title: Yii Framework - Search SQL Injection Vulnerability Google Dork: No Dork Date: 20/11/2012 Exploit Author: Junookyo Vendor Homepage: http://www.yiiframework.com/ Software Link: http://www.yiiframework.com/download/ Version: 1.1.8 maybe another version Vulnerability: SQL Injection via...

Yii Framework 1.1.8 - Search SQL Injection

Exploit Title: Yii Framework - Search SQL Injection Vulnerability Google Dork: No Dork Date: 20/11/2012 Exploit Author: Junookyo Vendor Homepage: http://www.yiiframework.com/ Software Link: http://www.yiiframework.com/download/ Version: 1.1.8 maybe another version Vulnerability: SQL Injection via...