Patrick Figel

The issue in CiviCRM is related to the possibility of uploading and executing PHAR archives. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

The issue concerns an eval injection that can lead to possible information disclosure, impact on data integrity, and execution of arbitrary code. This can be exploited via a specially crafted query string, for example, a malicious URL that injects unauthorized code. The `getSubmitValue` method, `validate` method, ` setOptions` method, ` findValue` method, and ` prepareValue` method in `HTML QuickForm`, `HTML QuickForm hierselect`, and `HTML QuickForm element` are affected.