CVE-2011-4825
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 39.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 39.16% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- phpletter/ajax file and image manager · phpmyfaq/phpmyfaq · tinymce/tinymce
- Source
- cve@mitre.org
References
- http://www.exploit-db.com/exploits/18075
- http://www.phpletter.com/en/DOWNLOAD/1/
- http://www.phpmyfaq.de/advisory_2011-10-25.php
- http://www.securityfocus.com/bid/50523Exploit
- http://www.zenphoto.org/trac/ticket/2005
- http://www.exploit-db.com/exploits/18075
- http://www.phpletter.com/en/DOWNLOAD/1/
- http://www.phpmyfaq.de/advisory_2011-10-25.php
- http://www.securityfocus.com/bid/50523Exploit
- http://www.zenphoto.org/trac/ticket/2005
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.