PT-2012-1863 · Sit! · Support Incident Tracker

Egidio Romano + 1 · Published 2012-01-29 · Updated 2012-02-02 · CVE-2011-4337

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Support Incident Tracker (aka SiT!) versions 3.45 through 3.65

Description A static code injection issue exists, allowing remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable.

Recommendations For versions 3.45 through 3.65, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the translate.php file and the i18n directory to minimize the risk of exploitation. Avoid using the lang variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-4337

Affected Products

Support Incident Tracker

References · 7

• 🔥 http://openwall.com/lists/oss-security/2011/11/22/3 · Exploit
• 🔥 http://bugs.sitracker.org/view.php?id=1737 · Exploit
• 🔥 http://securityfocus.com/archive/1/520577 · Exploit
• 🔥 http://exploit-db.com/exploits/18132 · Exploit
• 🔥 https://exploit-db.com/exploits/18132 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4337 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4337 · Note