CVE-2011-4075
Last modified
CVE-2011-4075 is a vulnerability of currently unknown severity. The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.. EPSS estimates a 51.89% chance of exploitation in the next 30 days.
Description
The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Phpldapadmin Project | Phpldapadmin | 1.2.0 |
| Phpldapadmin Project | Phpldapadmin | 1.2.0.1 |
| Phpldapadmin Project | Phpldapadmin | 1.2.0.2 |
| Phpldapadmin Project | Phpldapadmin | 1.2.0.3 |
| Phpldapadmin Project | Phpldapadmin | 1.2.0.4 |
| Phpldapadmin Project | Phpldapadmin | 1.2.0.5 |
| Phpldapadmin Project | Phpldapadmin | 1.2.1 |
| Phpldapadmin Project | Phpldapadmin | 1.2.1.1 |
References
- http://openwall.com/lists/oss-security/2011/10/24/9Exploit, Patch
- http://openwall.com/lists/oss-security/2011/10/25/2Exploit, Patch
- http://secunia.com/advisories/46551Vendor Advisory
- http://openwall.com/lists/oss-security/2011/10/24/9Exploit, Patch
- http://openwall.com/lists/oss-security/2011/10/25/2Exploit, Patch
- http://secunia.com/advisories/46551Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2011-4075?
How severe is CVE-2011-4075?
How do I fix CVE-2011-4075?
Are you affected by CVE-2011-4075?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST