CVE-2011-4960

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-09-17 · updated 2026-06-16
Weakness: CWE-89

Description

SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected products

Silverstripe: 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5 (+11)

References

http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12
http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3
https://github.com/silverstripe/sapphire/commit/fef7c32
http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12
http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3
https://github.com/silverstripe/sapphire/commit/fef7c32

Get alerted when CVE-2011-4960 or the next vulnerability affects your stack