CVE-2013-5350

The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object injection attacks, and execute arbitrary PHP code, via a crafted serialized object.

• CWE-20

• http://jvn.jp/en/jp/JVN69986880/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000009
• http://secunia.com/advisories/54043Vendor Advisory
• http://secunia.com/secunia_research/2014-1/Vendor Advisory
• https://www.openpne.jp/archives/12293/Vendor Advisory
• http://jvn.jp/en/jp/JVN69986880/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000009
• http://secunia.com/advisories/54043Vendor Advisory
• http://secunia.com/secunia_research/2014-1/Vendor Advisory
• https://www.openpne.jp/archives/12293/Vendor Advisory

Published

Jan 24, 2014

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-5344Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-5345Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-5346Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-5347Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-5348Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-5349Integer underflow in Picasa3.exe in Google Picasa before 3.9…
• CVE-2013-5351Heap-based buffer overflow in IrfanView before 4.37 allows r…
• CVE-2013-5352Sharetronix 3.1.1.3, 3.1.1, and earlier allows remote attack…
• CVE-2013-5353Unrestricted file upload vulnerability in system/controllers…
• CVE-2013-5354Multiple SQL injection vulnerabilities in Sharetronix 3.1.1 …
• CVE-2013-5355Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2013-5356Sharetronix 3.1.1.3, 3.1.1, and earlier does not properly re…