CVE-2011-4906

published 2020-02-12

CVE-2011-4906: Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.

Priority P2 67 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
joomla!	tiny_browser_included_with_tinymce_3.0	—	—
joomla!	tiny_browser_included_with_tinymce_3.0	—	—
tiny	tinybrowser	< 1.5.13	1.5.13

Detection & IOCs extracted from sources · hover to see the quote

path /libraries↗

• → The vulnerability allows arbitrary file upload via the TinyMCE Tiny Browser component in Joomla! before 1.5.13, resulting in remote PHP code execution. Monitor for unexpected PHP file uploads through the TinyMCE editor endpoint. ↗
• → Exploit code uses raw TCP socket connections (fsockopen) to interact with the target Joomla host and port, crafting HTTP requests manually to abuse the TinyMCE upload endpoint. Detect anomalous multipart file upload requests to TinyMCE-related paths on Joomla installations. ↗
• → Outdated/third-party deployments of TinyMCE may still be vulnerable. Audit all TinyMCE integrations for version 3.0 and below, including those embedded in marketing or CMS platforms. ↗

• · The vulnerability is specific to Joomla! versions before 1.5.13 using TinyMCE 3.0's Tiny Browser component. Upgraded or patched installations are not affected. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434