CVE-2011-4825

Exploit

EPSS 39.16%
Veröffentlicht 15.12.2011 03:57:34
Zuletzt bearbeitet 16.06.2026 23:35:28
Erkennungen
Login

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 8

NVD 41 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Phpletter ≫ Ajax File And Image Manager Version <= 1.0

Phpletter ≫ Ajax File And Image Manager Version 0.5

Phpletter ≫ Ajax File And Image Manager Version 0.5.5

Phpletter ≫ Ajax File And Image Manager Version 0.5.7

Phpletter ≫ Ajax File And Image Manager Version 0.6

Phpletter ≫ Ajax File And Image Manager Version 0.6.12

Phpletter ≫ Ajax File And Image Manager Version 0.7.8

Phpletter ≫ Ajax File And Image Manager Version 0.7.10

Phpletter ≫ Ajax File And Image Manager Version 0.8

Phpletter ≫ Ajax File And Image Manager Version 0.8.8

Phpletter ≫ Ajax File And Image Manager Version 0.8.9

Phpletter ≫ Ajax File And Image Manager Version 0.8.24

Phpletter ≫ Ajax File And Image Manager Version 0.9

Phpletter ≫ Ajax File And Image Manager Version 1.0 Update beta1

Phpletter ≫ Ajax File And Image Manager Version 1.0 Update beta2

Phpletter ≫ Ajax File And Image Manager Version 1.0 Update rc1

Phpletter ≫ Ajax File And Image Manager Version 1.0 Update rc2

Phpletter ≫ Ajax File And Image Manager Version 1.0 Update rc3

Phpletter ≫ Ajax File And Image Manager Version 1.0 Update rc4

Phpletter ≫ Ajax File And Image Manager Version 1.0 Update rc5

Phpmyfaq ≫ Phpmyfaq Version 2.6.0

Phpmyfaq ≫ Phpmyfaq Version 2.6.1

Phpmyfaq ≫ Phpmyfaq Version 2.6.2

Phpmyfaq ≫ Phpmyfaq Version 2.6.3

Phpmyfaq ≫ Phpmyfaq Version 2.6.4

Phpmyfaq ≫ Phpmyfaq Version 2.6.5

Phpmyfaq ≫ Phpmyfaq Version 2.6.6

Phpmyfaq ≫ Phpmyfaq Version 2.6.7

Phpmyfaq ≫ Phpmyfaq Version 2.6.8

Phpmyfaq ≫ Phpmyfaq Version 2.6.9

Phpmyfaq ≫ Phpmyfaq Version 2.6.10

Phpmyfaq ≫ Phpmyfaq Version 2.6.11

Phpmyfaq ≫ Phpmyfaq Version 2.6.12

Phpmyfaq ≫ Phpmyfaq Version 2.6.13

Phpmyfaq ≫ Phpmyfaq Version 2.6.14

Phpmyfaq ≫ Phpmyfaq Version 2.6.15

Phpmyfaq ≫ Phpmyfaq Version 2.6.16

Phpmyfaq ≫ Phpmyfaq Version 2.6.17

Phpmyfaq ≫ Phpmyfaq Version 2.6.18

Phpmyfaq ≫ Phpmyfaq Version 2.7.0

Tinymce ≫ Tinymce Version <= 1.4.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	39.16%	0.985

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://www.exploit-db.com/exploits/18075

http://www.phpletter.com/en/DOWNLOAD/1/

http://www.phpmyfaq.de/advisory_2011-10-25.php

http://www.securityfocus.com/bid/50523

Exploit

http://www.zenphoto.org/trac/ticket/2005

https://nvd.nist.gov/vuln/detail/CVE-2011-4825

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-4825

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-4825

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2011-4825