Floragasse 7 – 5th floor, 1040 Vienna
Subscribe to our Newsletter


SBA Security Advisory – phpWhois – PHP Code Injection (CVE-2015-5243)

Vulnerability Overview

phpWhois and some of its forks in versions before 5.1.0 are prone to a code injection vulnerability due to insufficient sanitization of returned WHOIS data. This allows attackers controlling the WHOIS information of a requested domain to execute arbitrary PHP code in the context of the application.

  • Type of Vulnerability: Code Injection
  • Fixed in Version: jsmitty12: 5.1.0
  • CVSSv3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVSSv3 Base Score: 9.8 (Critical)

Recommended Countermeasure

We recommend to update phpWhois to version jsmitty12: 5.1.0 or later. For further details, see the full security advisory.


Full Security Advisory