CVE-2011-4341

Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1) symphony/publish/comments or (2) symphony/publish/images. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks via error messages. NOTE: some of these details are obtained from third party information.

• CWE-79

• http://packetstormsecurity.org/files/view/106493/symphonycms-sqlxss.txt
• http://seclists.org/bugtraq/2011/Nov/8
• http://secunia.com/advisories/46663Vendor Advisory
• http://symphony-cms.com/download/releases/version/2.2.4/
• http://www.mavitunasecurity.com/xss-and-sql-injection-vulnerabilities-in-symphony-cms/
• http://www.openwall.com/lists/oss-security/2011/11/22/9Patch
• http://www.osvdb.org/76884
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71105
• https://github.com/symphonycms/symphony-2/commit/476e4926e2773588eab10dd3036f27e1411521b5
• http://packetstormsecurity.org/files/view/106493/symphonycms-sqlxss.txt
• http://seclists.org/bugtraq/2011/Nov/8
• http://secunia.com/advisories/46663Vendor Advisory
• http://symphony-cms.com/download/releases/version/2.2.4/
• http://www.mavitunasecurity.com/xss-and-sql-injection-vulnerabilities-in-symphony-cms/
• http://www.openwall.com/lists/oss-security/2011/11/22/9Patch
• http://www.osvdb.org/76884
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71105
• https://github.com/symphonycms/symphony-2/commit/476e4926e2773588eab10dd3036f27e1411521b5

Published

Feb 12, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-4335Multiple cross-site scripting (XSS) vulnerabilities in Conta…
• CVE-2011-4336Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" param…6.1
• CVE-2011-4337Static code injection vulnerability in translate.php in Supp…
• CVE-2011-4338Shaman 1.0.9: Users can add the line askforpwd=false to his …7.8
• CVE-2011-4339ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in …
• CVE-2011-4340Multiple cross-site scripting (XSS) vulnerabilities in Symph…
• CVE-2011-4342PHP remote file inclusion vulnerability in wp_xml_export.php…
• CVE-2011-4343Information disclosure vulnerability in Apache MyFaces Core …
• CVE-2011-4344Cross-site scripting (XSS) vulnerability in Jenkins Core in …
• CVE-2011-4345Cross-site scripting (XSS) vulnerability in Namazu before 2.…
• CVE-2011-4346Cross-site scripting (XSS) vulnerability in the web interfac…
• CVE-2011-4347The kvm_vm_ioctl_assign_device function in virt/kvm/assigned…