CVE-2011-4075

The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.

• CWE-94

• http://dev.metasploit.com/redmine/issues/5820Exploit
• http://openwall.com/lists/oss-security/2011/10/24/9Exploit, Patch
• http://openwall.com/lists/oss-security/2011/10/25/2Exploit, Patch
• http://osvdb.org/76594
• http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin%3Ba=blobdiff%3Bf=lib/functions.php%3Bh=eb160dc9f7d74e563131e21d4c85d7849a0c6638%3Bhp=19fde9974d4e5eb3bfac04bb223ccbefdb98f9a0%3Bhb=76e6dad13ef77c5448b8dfed1a61e4acc7241165%3Bhpb=5d4245f93ae6f065e7535f268e3cd87a23b07744
• http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page
• http://secunia.com/advisories/46551Vendor Advisory
• http://secunia.com/advisories/46672
• http://sourceforge.net/tracker/index.php?func=detail&aid=3417184&group_id=61828&atid=498546
• http://www.debian.org/security/2011/dsa-2333
• http://www.exploit-db.com/exploits/18021/Exploit
• http://www.securityfocus.com/bid/50331
• http://dev.metasploit.com/redmine/issues/5820Exploit
• http://openwall.com/lists/oss-security/2011/10/24/9Exploit, Patch
• http://openwall.com/lists/oss-security/2011/10/25/2Exploit, Patch
• http://osvdb.org/76594
• http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin%3Ba=blobdiff%3Bf=lib/functions.php%3Bh=eb160dc9f7d74e563131e21d4c85d7849a0c6638%3Bhp=19fde9974d4e5eb3bfac04bb223ccbefdb98f9a0%3Bhb=76e6dad13ef77c5448b8dfed1a61e4acc7241165%3Bhpb=5d4245f93ae6f065e7535f268e3cd87a23b07744
• http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page
• http://secunia.com/advisories/46551Vendor Advisory
• http://secunia.com/advisories/46672
• http://sourceforge.net/tracker/index.php?func=detail&aid=3417184&group_id=61828&atid=498546
• http://www.debian.org/security/2011/dsa-2333
• http://www.exploit-db.com/exploits/18021/Exploit
• http://www.securityfocus.com/bid/50331

Published

Nov 2, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-4066SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.0…
• CVE-2011-4068The check_password function in html/admin/login.php in Packe…
• CVE-2011-4069html/admin/login.php in PacketFence before 3.0.2 allows remo…
• CVE-2011-4072Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2011-4073Use-after-free vulnerability in the cryptographic helper han…
• CVE-2011-4074Cross-site scripting (XSS) vulnerability in cmd.php in phpLD…
• CVE-2011-4076OpenStack Nova before 2012.1 allows someone with access to a…5.9
• CVE-2011-4077Buffer overflow in the xfs_readlink function in fs/xfs/xfs_v…
• CVE-2011-4078include/iniset.php in Roundcube Webmail 0.5.4 and earlier, w…
• CVE-2011-4079Off-by-one error in the UTF8StringNormalize function in Open…
• CVE-2011-4080The sysrq_sysctl_handler function in kernel/sysctl.c in the …
• CVE-2011-4081crypto/ghash-generic.c in the Linux kernel before 3.1 allows…5.5