CVE-2011-4825
highPriorität · beachten · 54EPSS 0.392 · 99. PerzentilExploit · waffenfähigEUUSEPSS · bewertet 2026-10-27
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (8)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- exploit/multi/http/log1cms_ajax_create_folderLog1 CMS writeInfo() PHP Code Injectionwaffenfähig · metasploit
- EDB-18075Ajax File and Image Manager 1.0 Final - Remote Code Executionfunktional · exploit_db
- EDB-18083ZenPhoto 1.4.1.4 - 'ajax_create_folder.php' Remote Code Executionfunktional · exploit_db
- EDB-18084PHPMyFAQ 2.7.0 - 'ajax_create_folder.php' Remote Code Executionfunktional · exploit_db
- EDB-18085aidiCMS 3.55 - 'ajax_create_folder.php' Remote Code Executionfunktional · exploit_db
- EDB-18975Log1 CMS - 'writeInfo()' PHP Code Injection (Metasploit)funktional · exploit_db
betroffene Produkte (36)
Betroffene Produkte und Versionsbereiche.
- phpletter ajax file and image manager≤ 1.0nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.5nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.5.5nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.5.7nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.6nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.6.12nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.7.10nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.7.8nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.8nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.8.24nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.8.8nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.8.9nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 0.9nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
- phpletter ajax file and image manager= 1.0nvdUScpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (16)
Externe Belege — Patches, Meldungen, Analysen.
- http://log1cms.sourceforge.net/Patchcnnvd
- http://www.exploit-db.com/exploits/18075cnnvd
- http://www.phpletter.com/en/DOWNLOAD/1/cnnvd
- http://www.phpmyfaq.de/advisory_2011-10-25.phpcnnvd
- http://www.securityfocus.com/bid/50523cnnvd
- http://www.zenphoto.org/trac/ticket/2005cnnvd
- http://www.exploit-db.com/exploits/18075enisa_euvd
- http://www.phpletter.com/en/DOWNLOAD/1/enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan