CVE-2011-5147
published 2012-08-31CVE-2011-5147: Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows…
PriorityP337medium5CVSS 2.0
AVNACLAuNCNIPAN
EXPLOIT
EPSS
2.29%
81.0th percentile
Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document, as demonstrated by a call to ajax_file_cut.php and then to ajax_save_name.php.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freewebshop | freewebshop | <= 2.2.9 | — |
| freewebshop | freewebshop | — | — |
| freewebshop | freewebshop | — | — |
| freewebshop | freewebshop | — | — |
| freewebshop | freewebshop | — | — |
| freewebshop | freewebshop | — | — |
| freewebshop | freewebshop | — | — |
| freewebshop | freewebshop | — | — |
| freewebshop | freewebshop | — | — |
| freewebshop | freewebshop | — | — |
| freewebshop | freewebshop | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
FreeWebShop 2.2.9 R2 - 'ajax_save_name.php' Remote Code Execution
exploitdb·2011-11-16
CVE-2011-5147 FreeWebShop 2.2.9 R2 - 'ajax_save_name.php' Remote Code Execution
FreeWebShop 2.2.9 R2 - 'ajax_save_name.php' Remote Code Execution
---
get();
41. if(removeTrailingSlash($sessionAction->getFolder()) == getParentPath($_POST['id']) && sizeof($selectedDocuments))
42. {
43. if(($key = array_search(basename($_POST['id']), $selectedDocuments)) !== false)
44. {
45. $selectedDocuments[$key] = $_POST['value'];
46. $sessionAction->set($selectedDocuments);
47.
48. }
49. echo basename($_POST['id']) . "\n";
50. displayArray($selectedDocuments);
51.
52. }elseif(removeTrailingSlash($sessionAction->getFolder()) == removeTrailingSlash($_POST['id']))
53. {
54. $sessionAction->setFolder($_POST['id']);
55. }
56. writeInfo(ob_get_clean());
An attacker could be able to manipulate the $selectedDocuments array that will be displayed at line 50,
then at line 56 is called the
Exploit-DB
Zwii 2.1.1 - Remote File Inclusion
exploitdb·2011-01-08
CVE-2011-0505 Zwii 2.1.1 - Remote File Inclusion
Zwii 2.1.1 - Remote File Inclusion
---
# Exploit Title: Zwii v 2.1.1 Remote file include vulnerbility
# Google Dork: Propulsé par Zwii 2.1.1
# Date: 08/01/2011
# Author: Abdi Mohamed
# Software Link: http://scripts.toocharger.com/fiches/scripts/zwii/5147.htm
# Version: v 2.1.1
# Tested on: ubuntu + centos
# Email : [email protected] - [email protected]
#######################################################
Fichier : system.php
http://localhost/y/system/system.php
Code :
// Importe la base de données
include("./system/data/settings.php");
include("./system/data/articles.php");
include("./system/data/accounts.php");
include("./system/data/positions.php");
include("./system/data/ip.php");
include("./templates/". $set["template"]["value"] ."/info.php");
Exploit:
http://localh
No writeups or analysis indexed.
2012-08-31
Published