PT-2020-7144 · Joomla · Tinybrowser

Henri Salo · Published 2020-02-12 · Updated 2020-02-25 · CVE-2011-4908

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TinyBrowser plugin for Joomla! versions prior to 1.5.13

Description The issue allows for arbitrary file upload via the upload.php file. This can potentially lead to unauthorized access and malicious activities on the affected system.

Recommendations For versions prior to 1.5.13, update to version 1.5.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the upload.php file to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2011-4908

Affected Products

Tinybrowser

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/joomla_tinybrowser.rb · Exploit
• 🔥 https://exploit-db.com/exploits/9296 · Exploit
• 🔥 https://exploit-db.com/exploits/9926 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4908 · Security Note
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2011-4908 · Note
• https://t.me/cibsecurity/9805 · Telegram Post
• https://t.me/malwr/2331 · Telegram Post
• https://t.me/cvenotify/967 · Telegram Post
• https://openwall.com/lists/oss-security/2011/12/25/7 · Note