CVE-2014-125116

A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation script. The script remains accessible after deployment and fails to sanitize input before writing to the application’s config.php file. An unauthenticated attacker can inject arbitrary PHP code into config.php, which is later executed when the file is loaded. This allows attackers to achieve remote code execution on the server. Exploitation of this issue will overwrite the existing configuration, rendering the application non-functional.

• CWE-306
• CWE-434

• https://hybridauth.github.io/
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/hybridauth_install_php_exec.rb
• https://vulners.com/metasploit/MSF:EXPLOIT-UNIX-WEBAPP-HYBRIDAUTH_INSTALL_PHP_EXEC-
• https://www.exploit-db.com/exploits/34273
• https://www.exploit-db.com/exploits/34390
• https://www.vulncheck.com/advisories/hybridauth-unauth-rce-via-config-injection
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/hybridauth_install_php_exec.rb
• https://vulners.com/metasploit/MSF:EXPLOIT-UNIX-WEBAPP-HYBRIDAUTH_INSTALL_PHP_EXEC-
• https://www.exploit-db.com/exploits/34273

Published

Jul 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-125110A vulnerability has been found in wp-file-upload Plugin up t…3.5
• CVE-2014-125111A vulnerability was found in namithjawahar Wp-Insert up to 2…3.5
• CVE-2014-125112Plack::Middleware::Session::Cookie versions through 0.21 for…9.8
• CVE-2014-125113An unrestricted file upload vulnerability exists in Dell (ac…9.3
• CVE-2014-125114A stack-based buffer overflow vulnerability exists in i-Ftp …8.4
• CVE-2014-125115An unauthenticated SQL injection vulnerability exists in Pan…10
• CVE-2014-125117A stack-based buffer overflow vulnerability in the my_cgi.cg…9.8
• CVE-2014-125118A command injection vulnerability exists in the eScan Web Ma…9.4
• CVE-2014-125119A filename spoofing vulnerability exists in WinRAR when open…8.4
• CVE-2014-125120Rejected reason: This CVE has the been REJECTED and will not…
• CVE-2014-125121Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2…10
• CVE-2014-125122A stack-based buffer overflow vulnerability exists in the tm…5.3