CVE-2010-4335

CakePHP 1.2.8 and 1.3.x up to 1.3.5 are affected. The _validatePost function in libs/controller/components/security.php processes a crafted data[_Token][fields] value with unserialize, allowing remote attackers to modify the internal Cake cache and execute arbitrary code (demonstrated via modifyi...