CVE-2015-2945

mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015.

• CWE-94

• http://jvn.jp/en/jp/JVN64459670/index.htmlVendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000067Vendor Advisory
• http://www.h-fj.com/blog/archives/2015/05/15-112843.phpExploit, Vendor Advisory
• http://jvn.jp/en/jp/JVN64459670/index.htmlVendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000067Vendor Advisory
• http://www.h-fj.com/blog/archives/2015/05/15-112843.phpExploit, Vendor Advisory

Published

May 25, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2939Cross-site scripting (XSS) vulnerability in the Scribunto ex…
• CVE-2015-2940Cross-site request forgery (CSRF) vulnerability in the Check…
• CVE-2015-2941Cross-site scripting (XSS) vulnerability in MediaWiki before…
• CVE-2015-2942MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x bef…
• CVE-2015-2943Honda Moto LINC 1.6.1 does not verify SSL certificates.
• CVE-2015-2944Multiple cross-site scripting (XSS) vulnerabilities in Apach…
• CVE-2015-2946Stack-based buffer overflow in the Open CAD Format Council S…
• CVE-2015-2947KanColleViewer versions 3.8.1 and earlier operates as an ope…
• CVE-2015-2948Cross-site scripting (XSS) vulnerability in the image proces…
• CVE-2015-2949Cross-site scripting (XSS) vulnerability in ZenPhoto20 1.1.3…
• CVE-2015-2950Directory traversal vulnerability in the Brandon Bowles Open…
• CVE-2015-2951JWT.php in F21 JWT before 2.0 allows remote attackers to byp…