PT-2012-2125 · Moxiecode Systems+1 · Tinymce+1

Egidio Romano + 1 · Published 2012-08-31 · Updated 2013-09-12 · CVE-2011-5147

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeWebshop versions 2.2.9 R2 and earlier

Description A static code injection issue exists in the Ajax File Manager module of the tinymce plugin. This allows remote attackers to inject arbitrary PHP code into data.php via the selected document. The exploitation can be demonstrated by a call to ajax file cut.php and then to ajax save name.php.

Recommendations For FreeWebshop versions 2.2.9 R2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-5147

Affected Products

Freewebshop

Tinymce

References · 5

• 🔥 https://exploit-db.com/exploits/18121 · Exploit
• 🔥 http://exploit-db.com/exploits/18121 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5147 · Security Note
• http://freewebshop.org/forum/index.php?topic=5235.0 · Note
• http://osvdb.org/77162 · Note