PT-2020-7142 · Joomla+1 · Joomla!+1

Henri Salo · Published 2020-02-12 · Updated 2020-02-25 · CVE-2011-4906

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 1.5.13

Description The issue allows file upload and arbitrary PHP code execution through the Tiny browser in the TinyMCE 3.0 editor.

Recommendations For versions prior to 1.5.13, update to version 1.5.13 or later to resolve the issue.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2011-4906

Affected Products

Joomla!

Tinymce

References · 6

• 🔥 https://exploit-db.com/exploits/10183 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4906 · Security Note
• https://developer.joomla.org/security/news/301-20090722-core-file-upload.html · Vendor Advisory
• https://t.me/cibsecurity/9806 · Telegram Post
• https://t.me/cvenotify/965 · Telegram Post
• https://openwall.com/lists/oss-security/2011/12/25/7 · Note