CVEvulnerability
CVE-2011-4337
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2012-01-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
Static code injection vulnerability in translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable.
Affected configurations
• sitracker support incident tracker 3.6
• sitracker support incident tracker 3.45
• sitracker support incident tracker 3.50
• sitracker support incident tracker 3.51
• sitracker support incident tracker 3.60
• sitracker support incident tracker 3.61
• sitracker support incident tracker 3.62
• sitracker support incident tracker 3.63
• sitracker support incident tracker 3.64
• sitracker support incident tracker 3.65
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://bugs.sitracker.org/view.php?id=1737 Exploit
- http://www.exploit-db.com/exploits/18132/ Exploit
- http://www.openwall.com/lists/oss-security/2011/11/22/3 Exploit
- http://www.securityfocus.com/archive/1/520577 Exploit
- http://bugs.sitracker.org/view.php?id=1737 Exploit
- http://www.exploit-db.com/exploits/18132/ Exploit
- http://www.openwall.com/lists/oss-security/2011/11/22/3 Exploit
- http://www.securityfocus.com/archive/1/520577 Exploit