« Volver al listado

CVE-2011-4075

Estado: ModificadaAlta (7.5)—

The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phpldapadmin Project — Phpldapadmin

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-4075",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-11-02T17:55:01.387",
  "references": [
    {
      "url": "http://dev.metasploit.com/redmine/issues/5820",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/10/24/9",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/10/25/2",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://osvdb.org/76594",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin%3Ba=blobdiff%3Bf=lib/functions.php%3Bh=eb160dc9f7d74e563131e21d4c85d7849a0c6638%3Bhp=19fde9974d4e5eb3bfac04bb223ccbefdb98f9a0%3Bhb=76e6dad13ef77c5448b8dfed1a61e4acc7241165%3Bhpb=5d4245f93ae6f065e7535f268e3cd87a23b07744",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/46551",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/46672",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=3417184&group_id=61828&atid=498546",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2011/dsa-2333",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.exploit-db.com/exploits/18021/",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/50331",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://dev.metasploit.com/redmine/issues/5820",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/10/24/9",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/10/25/2",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/76594",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin%3Ba=blobdiff%3Bf=lib/functions.php%3Bh=eb160dc9f7d74e563131e21d4c85d7849a0c6638%3Bhp=19fde9974d4e5eb3bfac04bb223ccbefdb98f9a0%3Bhb=76e6dad13ef77c5448b8dfed1a61e4acc7241165%3Bhpb=5d4245f93ae6f065e7535f268e3cd87a23b07744",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/46551",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/46672",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=3417184&group_id=61828&atid=498546",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2011/dsa-2333",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/18021/",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/50331",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011."
    },
    {
      "lang": "es",
      "value": "La función masort en lib/functions.php en phpLDAPadmin v1.2.x antes de v1.2.2 permite a atacantes remotos ejecutar código PHP de su elección a través del parámetro orderby (también conocido como la variable SortBy) en una acción query_engine a cmd.php, tal y como fue \"explotado\" en Octubre de 2011."
    }
  ],
  "lastModified": "2026-06-16T23:34:22.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20FBCE2F-ACBA-4DA1-AE55-B287E3B8597A"
            },
            {
              "criteria": "cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "629C1EBF-667C-4C35-9E82-5009A4242B1B"
            },
            {
              "criteria": "cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "879C3DF2-7CBE-40D0-84A3-BACCF0E50A50"
            },
            {
              "criteria": "cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6848A21C-BFEE-4300-AB69-BF343EDB340B"
            },
            {
              "criteria": "cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F3F4309-CC01-4F52-9CBE-94BE4B055C67"
            },
            {
              "criteria": "cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC0434DC-A552-4512-A5CD-428AF21DC9BB"
            },
            {
              "criteria": "cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD2AE159-BCC4-4FAD-816F-A53392EADF9A"
            },
            {
              "criteria": "cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5F171FF-FD24-4C88-BAC0-B178513646AA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}