Vulnerability Details : CVE-2011-3829
Public exploit exists!
ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message.
Products affected by CVE-2011-3829
- cpe:2.3:a:sitracker:support_incident_tracker:3.65:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-3829
36.12%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2011-3829
-
Support Incident Tracker Remote Command Execution
Disclosure Date: 2011-11-10First seen: 2020-04-26exploit/multi/http/sit_file_uploadThis module combines two separate issues within Support Incident Tracker (<= 3.65) application to upload arbitrary data and thus execute a shell. The two issues exist in ftp_upload_file.php. The first vulnerability exposes the upload dir used to store attachments.
CVSS scores for CVE-2011-3829
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST |
CWE ids for CVE-2011-3829
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-3829
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/71233
Support Incident Tracker ftp_upload_file.php path disclosure CVE-2011-3829 Vulnerability Report
-
http://packetstormsecurity.org/files/106933/sit_file_upload.rb.txt
Support Incident Tracker 3.65 Remote Command Execution ≈ Packet StormExploit
-
http://www.exploit-db.com/exploits/18108
Support Incident Tracker 3.65 - Remote Command Execution (Metasploit) - PHP webapps ExploitExploit
-
http://secunia.com/secunia_research/2011-75/
Secunia Research Advisories | FlexeraVendor Advisory
-
http://www.securityfocus.com/bid/50632
Support Incident Tracker (SiT!) Multiple Input Validation VulnerabilitiesExploit
-
http://www.osvdb.org/76999
404 Not Found
-
http://secunia.com/advisories/45453
Sign inVendor Advisory
Jump to