CVE-2011-5130
Family Connections CMS 2.5.0-2.7.1 - Remote Code Execution via dev/less.php argv[1] Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2011-5130.
PoCs published by Metasploit, mr_me, including Metasploit module exploits/multi/http/familycms_less_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Family Connections 2.7.1 via the `dev/less.php` script due to insecure use of `system()`. It allows remote command execution without authentication but requires `register_globals` to be enabled.
Description
dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in Family Connections 2.7.1 via the `dev/less.php` script due to insecure use of `system()`. It allows remote command execution without authentication but requires `register_globals` to be enabled.
This exploit leverages a command injection vulnerability in Family Connections CMS versions 2.5.0 to 2.7.1 via the `argv[1]` parameter in `dev/less.php`. It allows remote command execution by injecting commands through the URL parameter, similar to CVE-2005-2651.
This Metasploit module exploits a command injection vulnerability in Family Connections CMS 2.7.1 via the `dev/less.php` script, leveraging insecure use of `system()` with user-controlled input in `argv[1]`. It does not require authentication but relies on `register_globals` being enabled.