{"api_version":"1","generated_at":"2026-07-23T00:58:00+00:00","cve":"CVE-2011-5136","urls":{"html":"https://cve.report/CVE-2011-5136","api":"https://cve.report/api/cve/CVE-2011-5136.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-5136","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-5136"},"summary":{"title":"CVE-2011-5136","description":"showImg.php in EPractize Labs Subscription Manager, possibly 1.0, allows remote attackers to overwrite arbitrary files via the db parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2012-08-30 22:55:04","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-20","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.4","severity":"","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://secunia.com/advisories/47072","name":"http://secunia.com/advisories/47072","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA47072 - EPractize Labs Subscription Manager "email" Code Injection Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71630","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71630","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/77505","name":"http://osvdb.org/77505","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2011/Dec/125","name":"http://seclists.org/fulldisclosure/2011/Dec/125","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Full Disclosure: Backdoor in EPractize Labs Online Subscription\tManager from epractizelabs.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-5136","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-5136","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"5136","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"epractizelabs","cpe5":"subscription_manager","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[{"cvename":"CVE-2011-5136","organization":"EPractize Labs Software","lastmodified":"2012-11-29","contributor":"","statementText":"The PHP is used for tracking open email report in Email Marketing Software Express. It will not be called in any of your free subscription manager PHPs. We removed showImg.php from the latest version. You can verify at http://www.epractizelabs.com/email-marketing/subscription-manager.html (click download, extract and verify the contents).","cve_year":"2011","cve_id":"5136","crc32":"caaad92a"}],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T00:23:40.234Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20111206 Backdoor in EPractize Labs Online Subscription Manager from epractizelabs.com","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2011/Dec/125"},{"name":"epractice-showimg-code-exec(71630)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71630"},{"name":"77505","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/77505"},{"name":"47072","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/47072"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-12-06T00:00:00.000Z","descriptions":[{"lang":"en","value":"showImg.php in EPractize Labs Subscription Manager, possibly 1.0, allows remote attackers to overwrite arbitrary files via the db parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20111206 Backdoor in EPractize Labs Online Subscription Manager from epractizelabs.com","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2011/Dec/125"},{"name":"epractice-showimg-code-exec(71630)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71630"},{"name":"77505","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/77505"},{"name":"47072","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/47072"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2011-5136","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"showImg.php in EPractize Labs Subscription Manager, possibly 1.0, allows remote attackers to overwrite arbitrary files via the db parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20111206 Backdoor in EPractize Labs Online Subscription Manager from epractizelabs.com","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2011/Dec/125"},{"name":"epractice-showimg-code-exec(71630)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71630"},{"name":"77505","refsource":"OSVDB","url":"http://osvdb.org/77505"},{"name":"47072","refsource":"SECUNIA","url":"http://secunia.com/advisories/47072"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2011-5136","datePublished":"2012-08-30T22:00:00.000Z","dateReserved":"2012-08-30T00:00:00.000Z","dateUpdated":"2024-08-07T00:23:40.234Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-08-30 22:55:04","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-20","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:epractizelabs:subscription_manager:1.0:*:*:*:*:*:*:*","matchCriteriaId":"8AFC52D7-BB44-4C7E-B7A8-BF4E3DFF5191"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"5136","Ordinal":"1","Title":"CVE-2011-5136","CVE":"CVE-2011-5136","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"5136","Ordinal":"1","NoteData":"showImg.php in EPractize Labs Subscription Manager, possibly 1.0, allows remote attackers to overwrite arbitrary files via the db parameter.","Type":"Description","Title":"CVE-2011-5136"},{"CveYear":"2011","CveId":"5136","Ordinal":"2","NoteData":"2012-08-30","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"5136","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}