PT-2012-1863 · Sit! · Support Incident Tracker

Egidio Romano + 1 · Publicado 2012-01-29 · Atualizado 2012-02-02 · CVE-2011-4337

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Support Incident Tracker (aka SiT!) versions 3.45 through 3.65

Description A static code injection issue exists, allowing remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable.

Recommendations For versions 3.45 through 3.65, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the translate.php file and the i18n directory to minimize the risk of exploitation. Avoid using the lang variable in the affected API endpoint until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-4337

Produtos afetados

Support Incident Tracker

Referências · 7

• 🔥 http://openwall.com/lists/oss-security/2011/11/22/3 · Exploit
• 🔥 http://bugs.sitracker.org/view.php?id=1737 · Exploit
• 🔥 http://securityfocus.com/archive/1/520577 · Exploit
• 🔥 http://exploit-db.com/exploits/18132 · Exploit
• 🔥 https://exploit-db.com/exploits/18132 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4337 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4337 · Nota