CVE-2011-4825

This Metasploit module exploits a PHP code injection vulnerability in Log1 CMS's Ajax File and Image Manager component. It writes arbitrary PHP code to data.php via the writeInfo() function, leading to remote code execution.

This PHP script exploits a remote code execution vulnerability in Zenphoto <= 1.4.1.4 by injecting malicious PHP code into a folder creation endpoint and then executing commands via a crafted HTTP request. The exploit establishes a shell-like interface for command execution.

This exploit targets a remote code execution vulnerability in phpMyFAQ <= 2.7.0 by leveraging an authenticated file upload flaw in ajax_create_folder.php. It authenticates, uploads a malicious PHP file, and executes arbitrary commands via HTTP headers.

This exploit targets a remote code execution vulnerability in aidiCMS v3.55 by injecting a malicious PHP payload into the 'ajax_create_folder.php' file. It then leverages the injected payload to execute arbitrary commands via a crafted HTTP request to 'data.php'.

The vulnerability in Ajax File and Image Manager v1.0 Final allows remote code execution due to improper handling of user-supplied input in the 'writeInfo' function, which writes arbitrary data to a PHP file without validation.

This exploit targets a remote code execution vulnerability in Log1CMS 2.0 via the ajax_create_folder.php endpoint. It injects a malicious PHP payload into a folder name, then triggers execution via a subsequent HTTP request with a base64-encoded command.

This Metasploit module exploits a PHP code injection vulnerability in Log1 CMS's Ajax File and Image Manager component. It leverages the writeInfo() function to write arbitrary PHP code to data.php, achieving remote code execution.