Back to KEVs

CVE-2011-5148

Multiple incomplete blacklist vulnerabilities in the Simple File Upload (mod_simplefileuploadv1.3) module before 1.3.5 for Joomla! allow remote...

Basic Information

CVE State
PUBLISHED
Reserved Date
August 31, 2012
Published Date
August 31, 2012
Last Updated
August 07, 2024
Vendor
Joomla!
Product
Simple File Upload
Description
Multiple incomplete blacklist vulnerabilities in the Simple File Upload (mod_simplefileuploadv1.3) module before 1.3.5 for Joomla! allow remote attackers to execute arbitrary code by uploading a file with a (1) php5, (2) php6, or (3) double (e.g. .php.jpg) extension, then accessing it via a direct request to the file in images/, as exploited in the wild in January 2012.
Tags
joomla php

CVSS Scores

CVSS v2.0

6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploit Status

Exploited in the Wild
Yes (2012-08-31 21:00:00 UTC) Source

References

http://www.exploit-db.com/exploits/18287 https://exchange.xforce.ibmcloud.com/vulnerabilities/72023 http://www.securityfocus.com/bid/51214 http://www.securityfocus.com/bid/51234 http://www.osvdb.org/78122 http://wasen.net/index.php?option=com_content&view=article&id=87&Itemid=59 http://secunia.com/advisories/47370 http://docs.joomla.org/Vulnerable_Extensions_List#Simple_File_Upload_1.3

Known Exploited Vulnerability Information

Source Added Date
CVE 2012-08-31 21:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel