CVE-2015-6836
HighSummary
The __call method in the SoapClient class in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, allowing remote attackers to execute arbitrary code via crafted serialized data that triggers a 'type confusion' in the serialize_function_call function.
Risk Assessment
This vulnerability may lead to remote code execution, posing a serious threat to the security of the application and the organization's data.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to regularly monitor and audit applications using SoapClient.
Other vulnerabilities in PHP SoapClient
Original NVD description (English source)
The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which allows remote attackers to execute arbitrary code via crafted serialized data that triggers a "type confusion" in the serialize_function_call function.