Back to KEVs

CVE-2011-4075

The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby...

Basic Information

CVE State
PUBLISHED
Reserved Date
October 18, 2011
Published Date
November 02, 2011
Last Updated
August 06, 2024
Vendor
phpLDAPadmin
Product
phpLDAPadmin
Description
The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.
Tags
php metasploit_scanner

CVSS Scores

CVSS v2.0

7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploit Status

Exploited in the Wild
Yes (2011-11-02 17:00:00 UTC) Source

References

http://sourceforge.net/tracker/index.php?func=detail&aid=3417184&group_id=61828&atid=498546 http://osvdb.org/76594 http://www.securityfocus.com/bid/50331 http://openwall.com/lists/oss-security/2011/10/25/2 http://www.exploit-db.com/exploits/18021/ http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin%3Ba=blobdiff%3Bf=lib/functions.php%3Bh=eb160dc9f7d74e563131e21d4c85d7849a0c6638%3Bhp=19fde9974d4e5eb3bfac04bb223ccbefdb98f9a0%3Bhb=76e6dad13ef77c5448b8dfed1a61e4acc7241165%3Bhpb=5d4245f93ae6f065e7535f268e3cd87a23b07744 http://dev.metasploit.com/redmine/issues/5820 http://secunia.com/advisories/46672 http://secunia.com/advisories/46551 http://openwall.com/lists/oss-security/2011/10/24/9 http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page http://www.debian.org/security/2011/dsa-2333

Known Exploited Vulnerability Information

Source Added Date
CVE 2011-11-02 17:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpldapadmin_query_engine.rb 2025-04-29 11:01:23 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

phpldapadmin_query_engine

Type: metasploit • Created: Unknown

Metasploit module for CVE-2011-4075

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Metasploit