Vulnerability Details : CVE-2011-1513
Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name.
Products affected by CVE-2011-1513
- cpe:2.3:a:e107:e107:*:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.545:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.603:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.554:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.610:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.615:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.615a:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.611:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.612:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.613:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.614:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.616:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.607:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.608:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.600:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.601:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.602:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.609:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.617:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.604:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.605:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.606:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.6172:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.6171:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.6174:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.6173:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.6175:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.8:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.11:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.10:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.9:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.13:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.14:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.15:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.12:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.17:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.18:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.553:beta:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.551:beta:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.552:beta:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.547:beta:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.554:beta:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.555:beta:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.16:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.548:beta:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.549:beta:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.19:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.20:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.21:*:*:*:*:*:*:*
- cpe:2.3:a:e107:e107:0.7.22:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-1513
0.62%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 79 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-1513
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2011-1513
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-1513
-
http://www.coresecurity.com/content/e107-cms-script-command-injection
e107 CMS Script Command Injection | Core SecurityExploit;Patch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/70921
e107 cmd command execution CVE-2011-1513 Vulnerability Report
-
http://www.securityfocus.com/bid/50339
e107 'cmd' Parameter Remote Command Execution VulnerabilityExploit
-
http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.8/install_.php?r1=11931&r2=12376&pathrev=12376
404 Not FoundPatch
Jump to