PT-2011-5160 · Quixplorer · Quixplorer

Krhr_Krhr + 1 · Published 2011-12-25 · Updated 2017-08-29 · CVE-2011-5005

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuiXplorer versions 2.3 and earlier

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension using the "upload action" to "index.php", then accessing it via a direct request to the file in an unspecified directory.

Recommendations For QuiXplorer versions 2.3 and earlier, consider restricting or disabling the file upload functionality, specifically the upload action to "index.php", until a fix is available. Additionally, restrict access to directories where uploaded files are stored to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2011-5005

Affected Products

Quixplorer

References · 5

• 🔥 http://exploit-db.com/exploits/18118 · Exploit
• 🔥 https://exploit-db.com/exploits/18118 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5005 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71323 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5005 · Note