CVE-2012-5223

Name of the Vulnerable Software and Affected Versions vBSEO versions 3.5.0 through 3.6.0 and earlier

Description The issue allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char repl parameter. This parameter is inserted into a regular expression that is processed by the preg replace function with the eval switch.

Recommendations For vBSEO versions 3.5.0 through 3.6.0 and earlier, consider disabling the proc deutf function in includes/functions vbseocp abstract.php until a patch is available. Restrict access to the char repl parameter to minimize the risk of exploitation. Avoid using the char repl parameter in the affected API endpoint until the issue is resolved.