JVN#64459670: mt-phpincgi vulnerable to PHP object injection

mt-phpincgi is script that runs Movable Type templates as PHP. mt-phpincgi contains a PHP object Injection vulnerability.

According to the reporter, attacks that attempt to exploit this vulnerability have been confirmed.

Impact

Arbitrary PHP code may be executed on the server by an unauthenticated attacker.

Solution

Apply the update
The developer has released an update at mt-phpincgi.php security update.
Apply the update according to the information provided by the developer.

Products Affected

• mt-phpincgi
  This vulnerability has been addressed in mt-phpincgi.php security update released on 2015/05/15.