Unscored severity · published May 31, 2011
CVE-2011-1329
WalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which allows remote attackers to execute arbitrary PHP code via vectors involving a double…
–
CVSS
1.4%
EPSS
No
On KEV
Description
WalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which allows remote attackers to execute arbitrary PHP code via vectors involving a double extension, as demonstrated by a .php.zzz file.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Walrack · Walrus Digit
1.0.1; 1.1.1; 1.1.2; 1.1.3; 1.1.4; 1.1.5; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1329
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1329
Patch
http://digit.que.ne.jp/work/index.cgi?WalRack
Patch
http://digit.que.ne.jp/work/index.cgi?WalRack2
jvn.jp
http://jvn.jp/en/jp/JVN46984044/54827/index.html
jvn.jp
http://jvn.jp/en/jp/JVN46984044/index.html
jvndb.jvn.jp
http://jvndb.jvn.jp/jvndb/JVNDB-2011-000032
www.securityfocus.com
http://www.securityfocus.com/bid/48001
More from Walrack
–
CVE-2011-2215
Unspecified vulnerability in WalRack 1.x before 1.1.8 and 2.x before 2.0.6 has unknown impact and attack vectors, possibly related to file deletion and an encoded URL, a different…