Vulnerability Details : CVE-2011-3833

Public exploit exists!
Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Published 2012-01-29 04:04:45
Updated 2017-08-29 01:30:19
Source Flexera Software LLC
View at NVD,   CVE.org

Products affected by CVE-2011-3833

Exploit prediction scoring system (EPSS) score for CVE-2011-3833

EPSS FAQ
1.05%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 84 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2011-3833

  • Support Incident Tracker Remote Command Execution
    Disclosure Date: 2011-11-10
    First seen: 2020-04-26
    exploit/multi/http/sit_file_upload
    This module combines two separate issues within Support Incident Tracker (<= 3.65) application to upload arbitrary data and thus execute a shell. The two issues exist in ftp_upload_file.php. The first vulnerability exposes the upload dir used to store attachments.

CVSS scores for CVE-2011-3833

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.0
 MEDIUM AV:N/AC:M/Au:S/C:P/I:P/A:P
6.8
6.4
 NIST

References for CVE-2011-3833

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close