Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9gnz-bcac-5ygs
Vulnerability ID VCID-9gnz-bcac-5ygs
Aliases CVE-2014-8684
GHSA-w9ph-q4h9-rwq6
Summary CodeIgniter and Kohana vulnerable to PHP Object Injection CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-310 Cryptographic Issues
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 9.8 http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
generic_textual CRITICAL http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
epss 0.44845 https://api.first.org/data/v1/epss?cve=CVE-2014-8684
cvssv3.1 9.8 http://seclists.org/fulldisclosure/2014/May/54
generic_textual CRITICAL http://seclists.org/fulldisclosure/2014/May/54
cvssv3.1 9.8 https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L159
generic_textual CRITICAL https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L159
cvssv3.1 9.8 https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f32
generic_textual CRITICAL https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f32
cvssv3.1 9.8 https://github.com/kohana/core/pull/492
generic_textual CRITICAL https://github.com/kohana/core/pull/492
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2014-8684
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2014-8684
cvssv3.1 9.8 https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
generic_textual CRITICAL https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
Reference id Reference type URL
http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
https://api.first.org/data/v1/epss?cve=CVE-2014-8684
http://seclists.org/fulldisclosure/2014/May/54
https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L159
https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f32
https://github.com/kohana/core/pull/492
https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
CVE-2014-8684 https://nvd.nist.gov/vuln/detail/CVE-2014-8684
CVE-2014-8686;CVE-2014-8684;OSVDB-118925;CVE-2014-8687 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/remote/36264.rb
GHSA-w9ph-q4h9-rwq6 https://github.com/advisories/GHSA-w9ph-q4h9-rwq6
Data source Metasploit
Description Some Seagate Business NAS devices are vulnerable to command execution via a local file include vulnerability hidden in the language parameter of the CodeIgniter session cookie. The vulnerability manifests in the way the language files are included in the code on the login page, and hence is open to attack from users without the need for authentication. The cookie can be easily decrypted using a known static encryption key and re-encrypted once the PHP object string has been modified. This module has been tested on the STBN300 device.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date March 1, 2015
Platform PHP
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb
Data source Exploit-DB
Date added March 4, 2015
Description Seagate Business NAS - Remote Command Execution (Metasploit)
Ransomware campaign use Known
Source publication date March 4, 2015
Exploit type remote
Platform php
Source update date April 1, 2017
Source URL https://beyondbinary.io/advisory/seagate-nas-rce/
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://seclists.org/fulldisclosure/2014/May/54
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L159
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f32
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/kohana/core/pull/492
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2014-8684
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.97647
EPSS Score 0.44845
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:43:44.871377+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/codeigniter/framework/CVE-2014-8684.yml 38.6.0