CVE-2011-4825

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 39.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-12-15 · updated 2026-06-16
Weakness: CWE-94

Description

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.

Affected products

Phpletter Ajax File And Image Manager: through 1.0; 0.5, 0.5.5, 0.5.7, 0.6, 0.6.12, 0.7.8 (+13)
thorsten phpMyFAQ: 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5 (+14)
Tinymce: through 1.4.1

References

http://www.exploit-db.com/exploits/18075
http://www.phpletter.com/en/DOWNLOAD/1/
http://www.phpmyfaq.de/advisory_2011-10-25.php
http://www.securityfocus.com/bid/50523
http://www.zenphoto.org/trac/ticket/2005
http://www.exploit-db.com/exploits/18075
http://www.phpletter.com/en/DOWNLOAD/1/
http://www.phpmyfaq.de/advisory_2011-10-25.php
http://www.securityfocus.com/bid/50523
http://www.zenphoto.org/trac/ticket/2005

Get alerted when CVE-2011-4825 or the next vulnerability affects your stack