CVE-2015-8980

Vulnerability

The php-gettext library before version 1.0.12 contains a code injection vulnerability in the ngettext, npgettext, and select_string functions. The plural form formula is evaluated using eval() or similar, and if the count parameter is passed unsanitized from an untrusted user, arbitrary PHP code can be injected [1][2][3]. Affected versions are all prior to 1.0.12.

Exploitation

An attacker can exploit this by providing a malicious count value to any application that uses the ngettext family of calls with user-supplied input. No authentication is required if the application exposes this functionality to unauthenticated users. The attacker crafts a string that, when evaluated as part of the plural formula, executes arbitrary PHP code [1][3].

Impact

Successful exploitation allows remote attackers to execute arbitrary PHP code on the server, leading to full compromise of the application and potentially the underlying system. This includes data theft, modification, or denial of service [1][2][3].

Mitigation

The vulnerability is fixed in php-gettext version 1.0.12, released on 2016-12-09 [2][4]. Users should upgrade to this version or later. The fix throws an exception if the count parameter is not a number, preventing code injection [2]. No workaround is available other than upgrading. The issue is tracked in Red Hat Bugzilla [3] and Fedora updates [4].