CVE-2011-5147 Code injection in n/a
Remote attackers can inject arbitrary PHP code into the Ajax File Manager module of the TinyMCE plugin in FreeWebshop, leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-5147?
CVE-2011-5147 is a medium-severity code injection vulnerability in n/a, published on 31 Aug 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document, as demonstrated by a call to ajax_file_cut.php and then to ajax_save_name.php.
Weakness: CWE-94
Which versions are affected by CVE-2011-5147?
It affects 1 product.
Products include Freewebshop Freewebshop.
How do I fix CVE-2011-5147?
No fix has been published for CVE-2011-5147 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2011-5147 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-5147 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-74gm-m639-vvwh.