CVE-2011-5148
EXPLOITED IN THE WILDmod_simplefileupload < 1.3.5 - Remote Code Execution via Incomplete Blacklist Bypass
Title source: manualExploitation Summary
CVE-2011-5148 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit from researchers including gmda.
AI-analyzed exploit summary This PHP script exploits a file upload vulnerability in Simple File Upload v1.3 for Joomla, allowing remote code execution by uploading a malicious file disguised as an image. The exploit sends a crafted multipart/form-data POST request to bypass file type restrictions.
Description
Multiple incomplete blacklist vulnerabilities in the Simple File Upload (mod_simplefileuploadv1.3) module before 1.3.5 for Joomla! allow remote attackers to execute arbitrary code by uploading a file with a (1) php5, (2) php6, or (3) double (e.g. .php.jpg) extension, then accessing it via a direct request to the file in images/, as exploited in the wild in January 2012.
Exploits (1)
This PHP script exploits a file upload vulnerability in Simple File Upload v1.3 for Joomla, allowing remote code execution by uploading a malicious file disguised as an image. The exploit sends a crafted multipart/form-data POST request to bypass file type restrictions.