CVE-2011-10011
CRITICALWeBid < 1.0.2 - Unauthenticated Remote Code Execution via Converter.php to Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2011-10011.
PoCs published by Metasploit, EgiX, EgiX, juan vazquez, including Metasploit module exploits/linux/http/webid_converter.
AI-analyzed exploit summary This Metasploit module exploits a PHP code injection vulnerability in WeBid 1.0.2 via the converter.php file, allowing unauthenticated remote code execution by injecting payloads into includes/currencies.php.
Description
WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remote code execution when the modified script is accessed or included by the application.
Exploits (3)
This Metasploit module exploits a PHP code injection vulnerability in WeBid 1.0.2 via the converter.php file, allowing unauthenticated remote code execution by injecting payloads into includes/currencies.php.
This exploit targets WeBid <= 1.0.2, leveraging an arbitrary PHP code injection vulnerability in converter.php to achieve remote code execution. It injects malicious code into the currencies.php file via unsanitized POST parameters, then executes commands through a crafted payload.
This Metasploit module exploits a PHP code injection vulnerability in WeBid 1.0.2 via the converter.php file, allowing unauthenticated remote code execution by injecting payloads into includes/currencies.php.
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H