Ajax File and Image Manager 'data.php' PHP Code Injection Vulnerability

Bugtraq ID:	50523
Class:	Input Validation Error
CVE:	CVE-2011-4825
Remote:	Yes
Local:	No
Published:	Nov 04 2011 12:00AM
Updated:	Jun 04 2012 11:30AM
Credit:	EgiX
Vulnerable:	Zenphoto zenphoto 1.4 3 Zenphoto zenphoto 1.3.1 Zenphoto zenphoto 1.2.5 Zenphoto zenphoto 1.4.1.4 Zenphoto zenphoto 1.4.0.3 Zenphoto zenphoto 1.3 phpMyFAQ phpMyFAQ 2.7 phpMyFAQ phpMyFAQ 2.6.19 phpMyFAQ phpMyFAQ 2.5.5 phpMyFAQ phpMyFAQ 2.5.4 phpMyFAQ phpMyFAQ 2.5.2 phpMyFAQ phpMyFAQ 2.5.1 phpMyFAQ phpMyFAQ 2.5 -dev phpMyFAQ phpMyFAQ 2.5 phpMyFAQ phpMyFAQ 2.0.17 phpMyFAQ phpMyFAQ 2.0.16 phpMyFAQ phpMyFAQ 2.0.15 phpMyFAQ phpMyFAQ 2.0.14 phpMyFAQ phpMyFAQ 2.0.13 phpMyFAQ phpMyFAQ 2.0.12 phpMyFAQ phpMyFAQ 2.0.11 phpMyFAQ phpMyFAQ 2.0.10 phpMyFAQ phpMyFAQ 2.0.9 phpMyFAQ phpMyFAQ 2.0.8 phpMyFAQ phpMyFAQ 2.0.7 phpMyFAQ phpMyFAQ 2.0.6 phpMyFAQ phpMyFAQ 2.0.5 phpMyFAQ phpMyFAQ 2.0.4 phpMyFAQ phpMyFAQ 2.0.3 phpMyFAQ phpMyFAQ 2.0.2 phpMyFAQ phpMyFAQ 2.0.1 phpMyFAQ phpMyFAQ 2.0 phpMyFAQ phpMyFAQ 1.6.8 phpMyFAQ phpMyFAQ 1.6.7 phpMyFAQ phpMyFAQ 1.5.4 phpMyFAQ phpMyFAQ 1.5.3 phpMyFAQ phpMyFAQ 1.5.1 phpMyFAQ phpMyFAQ 1.5 RC5 phpMyFAQ phpMyFAQ 1.5 RC4 phpMyFAQ phpMyFAQ 1.5 RC3 phpMyFAQ phpMyFAQ 1.5 RC2 phpMyFAQ phpMyFAQ 1.5 RC1 phpMyFAQ phpMyFAQ 1.5 beta3 phpMyFAQ phpMyFAQ 1.5 beta2 phpMyFAQ phpMyFAQ 1.5 beta1 phpMyFAQ phpMyFAQ 1.5 alpha2 phpMyFAQ phpMyFAQ 1.5 alpha1 phpMyFAQ phpMyFAQ 1.5 phpMyFAQ phpMyFAQ 1.4.9 phpMyFAQ phpMyFAQ 1.4.8 phpMyFAQ phpMyFAQ 1.4.7 phpMyFAQ phpMyFAQ 1.4.6 phpMyFAQ phpMyFAQ 1.4.5 phpMyFAQ phpMyFAQ 1.4.4 phpMyFAQ phpMyFAQ 1.4.3 phpMyFAQ phpMyFAQ 1.4.2 phpMyFAQ phpMyFAQ 1.4.1 phpMyFAQ phpMyFAQ 1.4 a phpMyFAQ phpMyFAQ 1.4 -alpha 2 phpMyFAQ phpMyFAQ 1.4 -alpha 1 phpMyFAQ phpMyFAQ 1.4 phpMyFAQ phpMyFAQ 1.3.13 phpMyFAQ phpMyFAQ 1.3.12 phpMyFAQ phpMyFAQ 2.6.9 phpMyFAQ phpMyFAQ 2.6.8 phpMyFAQ phpMyFAQ 2.6.7 phpMyFAQ phpMyFAQ 2.6.6 phpMyFAQ phpMyFAQ 2.6.5 phpMyFAQ phpMyFAQ 2.6.4 phpMyFAQ phpMyFAQ 2.6.3 phpMyFAQ phpMyFAQ 2.6.2 phpMyFAQ phpMyFAQ 2.6.13 phpMyFAQ phpMyFAQ 2.6.12 phpMyFAQ phpMyFAQ 2.6.11 phpMyFAQ phpMyFAQ 2.6.1 phpMyFAQ phpMyFAQ 2.6.0 PHPLETTER.COM Ajax File and Image Manager 1.0 Paul Jova Manx 1.0.1 Log1CMS Log1CMS 2.0 aidiCMS aidiCMS 3.55
Not Vulnerable:	Zenphoto zenphoto 1.4.2

Ajax File and Image Manager 'data.php' PHP Code Injection Vulnerability

Ajax File and Image Manager is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Ajax File and Image Manager 1.0 is vulnerable; other versions may also be affected.

Ajax File and Image Manager 'data.php' PHP Code Injection Vulnerability

Attackers can exploit this issue through a browser.

The following exploits are available:

• /data/vulnerabilities/exploits/50523_1.php
• /data/vulnerabilities/exploits/50523_2.php
• /data/vulnerabilities/exploits/50523_3.php
• /data/vulnerabilities/exploits/50523_4.php
• /data/vulnerabilities/exploits/50523.rb

Ajax File and Image Manager 'data.php' PHP Code Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Ajax File and Image Manager 'data.php' PHP Code Injection Vulnerability

References:

• Ajax File and Image Manager Homepage (phpletter)
  
• Log1CMS Homepage (Log1CMS)
  
• Remote Code Execution Vulnerability (Zenphoto)
  
• Zingiri Web Shop Homepage (WordPress)