Arbitrary Code Execution

yiisoft/yii is vulnerable to Arbitrary Code Execution. The vulnerability exists in wakeup function at CDbCriteria.php which allows an attacker to inject and execute arbitrary codes if the unserialize method is called on untrusted user input...