CVE-2014-2293

CVE-2014-2293 is a critical PHP object injection vulnerability affecting Zikula Application Framework versions prior to 1.3.7 build 11. This flaw allows unauthenticated remote attackers to execute arbitrary PHP code, delete files, or manipulate data by injecting crafted serialized data into specific parameters. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low complexity, and complete compromise potential (C, I, A High). While there is no known active exploitation or publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.