Yii2 Starter Kit
Monthly
Unauthenticated remote attackers who can reach a yii2-starter-kit deployment (through version 4.2.0) running with its default development configuration can read sensitive runtime data and write arbitrary PHP files. The dev profile sets the Yii debug and Gii modules' allowedIPs to ['*'] in common/config/web.php, so the debug endpoint leaks session cookies and executed database queries (C:H) while the Gii code generator can be abused to create attacker-controlled PHP in the application directory (I:H), a practical path to remote code execution. Exploitation requires the application to be network-exposed while still running the development/staging configuration; a properly hardened production deployment restricts allowedIPs (typically to localhost). No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS data was not supplied.
Authenticated users holding the backend 'manager' role in yii2-starter-kit through 4.2.0 can upload PHP scripts through the backend file-storage upload action and then request them from the web-accessible storage directory, achieving remote code execution as the web server user. The defect is an unrestricted file upload (CWE-434) with a CVSS 4.0 base score of 8.7 (PR:L, fully consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation is gated on manager-level authentication, on the backend file-storage module being enabled and reachable, and on the storage directory being served without script-execution restrictions, which is the default starter-kit layout. No public exploit code identified at time of analysis, and the practical priority is tempered by the authentication prerequisite and the niche footprint of the product, though the impact is total for any live deployment that meets those preconditions.
Unauthenticated information disclosure in the yii2-starter-kit application template through version 4.2.0 allows remote attackers to download file attachments that belong to unpublished (draft) articles by calling the attachment-download endpoint directly. The endpoint in frontend/controllers/ArticleController.php serves the requested file without verifying the publication status of the parent article, and because attachment identifiers are sequential and predictable, an attacker can enumerate them to harvest draft content; no credentials, user interaction, or non-default configuration are needed (CVSS:4.0 PR:N/UI:N, assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N with C:L only). Impact is confined to reading draft attachments - there is no write, modification, or denial-of-service effect - and no public exploit code or confirmed active exploitation has been identified at time of analysis, so real-world risk depends mainly on whether a deployed site built from this starter kit leaves the vulnerable controller unmodified.
Unauthenticated remote attackers who can reach a yii2-starter-kit deployment (through version 4.2.0) running with its default development configuration can read sensitive runtime data and write arbitrary PHP files. The dev profile sets the Yii debug and Gii modules' allowedIPs to ['*'] in common/config/web.php, so the debug endpoint leaks session cookies and executed database queries (C:H) while the Gii code generator can be abused to create attacker-controlled PHP in the application directory (I:H), a practical path to remote code execution. Exploitation requires the application to be network-exposed while still running the development/staging configuration; a properly hardened production deployment restricts allowedIPs (typically to localhost). No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS data was not supplied.
Authenticated users holding the backend 'manager' role in yii2-starter-kit through 4.2.0 can upload PHP scripts through the backend file-storage upload action and then request them from the web-accessible storage directory, achieving remote code execution as the web server user. The defect is an unrestricted file upload (CWE-434) with a CVSS 4.0 base score of 8.7 (PR:L, fully consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation is gated on manager-level authentication, on the backend file-storage module being enabled and reachable, and on the storage directory being served without script-execution restrictions, which is the default starter-kit layout. No public exploit code identified at time of analysis, and the practical priority is tempered by the authentication prerequisite and the niche footprint of the product, though the impact is total for any live deployment that meets those preconditions.
Unauthenticated information disclosure in the yii2-starter-kit application template through version 4.2.0 allows remote attackers to download file attachments that belong to unpublished (draft) articles by calling the attachment-download endpoint directly. The endpoint in frontend/controllers/ArticleController.php serves the requested file without verifying the publication status of the parent article, and because attachment identifiers are sequential and predictable, an attacker can enumerate them to harvest draft content; no credentials, user interaction, or non-default configuration are needed (CVSS:4.0 PR:N/UI:N, assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N with C:L only). Impact is confined to reading draft attachments - there is no write, modification, or denial-of-service effect - and no public exploit code or confirmed active exploitation has been identified at time of analysis, so real-world risk depends mainly on whether a deployed site built from this starter kit leaves the vulnerable controller unmodified.