cbcvebase.
CVE-2011-4908
published 2020-02-12

CVE-2011-4908: TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.

PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
55.77%
98.9th percentile
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.

Affected

3 ranges
VendorProductVersion rangeFixed in
joomla!tinybrowser_plugin
joomla!tinybrowser_plugin
tinytinybrowser< 1.5.131.5.13

Detection & IOCsextracted from sources · hover to see the quote

path/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload.php
path/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload_file.php
path/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload_process.php
path/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/edit.php
path/images/stories/
urlupload.php?badfiles=1">alert(/XSS/)
  • Detect exploit check requests: HTTP GET to the tinybrowser upload.php path with query parameters type=file&folder= that returns a response body containing 'flexupload.swf' indicates a vulnerable instance.
  • Alert on unauthenticated access to the tinybrowser directory path jscripts/tiny_mce/plugins/tinybrowser from external sources; the directory is accessible without authentication by default.
  • Monitor for arbitrary folder creation via tinybrowser.php: HTTP GET requests to tinybrowser.php?type=image&folder=<arbitrary_name> that result in new directory creation under useruploads/images/.
  • Detect successful file upload exploitation by monitoring HTTP GET requests to /images/stories/*.php following prior POST activity to the tinybrowser upload endpoints.
  • ·The tinybrowser config ships with an unrestricted file upload size (maxsize=0) and a prohibited extensions list that can be bypassed via double-extension tricks (e.g., .ph.p). Verify your config_tinybrowser.php enforces strict extension and size controls.
  • ·The plugin lacks CSRF protection on all major file/folder operations (create, delete, rename), making it trivially exploitable via cross-site request forgery even if authentication is added.
  • ·GET/POST variables in upload.php (goodfiles, badfiles, dupfiles) are unsanitized and reflected, enabling XSS. Input validation must be applied to all tinybrowser endpoints.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.