Denial of Service Vulnerability in Mikecao Flight PHP Framework

CVE-2014-125127

What is CVE-2014-125127?

The Mikecao Flight PHP framework is susceptible to Denial of Service attacks due to the immediate loading of request bodies in its Request class constructor. This behavior occurs across all HTTP requests, irrespective of whether the application actually requires the entire request body. An attacker can exploit this design flaw by sending requests with excessively large data payloads, leading to significant memory consumption. This can exhaust server memory resources, resulting in application crashes or denial of service to legitimate users. The issue has been addressed in version 1.2, which introduced lazy loading of request bodies to mitigate this risk.

References