CVE Feed

    Dashboard / CVE / CVE-2011-2148

    CVE-2011-2148

    Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & (ampersand) character, and (1) an STTTState cookie, (2) the ctl00%24MPH%24txtAdminNewPassword_SettingText parameter, (3) the ctl00%24MPH%24txtSmarterLogDirectory parameter, (4) the ctl00%24MPH%24ucSiteSeoSearchEngineSettings%24chklistEngines_SettingCheckBox%2414 parameter, (5) the ctl00%24MPH%24ucSiteSeoSettings%24txtSeoMaxKeywords_SettingText parameter, or (6) the ctl00_MPH_grdLogLocations_HiddenLSR parameter, related to an "OS command injection" issue.

    Published:May 20, 2011
    Last Modified:Apr 11, 2025
    EPS:May 20, 2011
    EPSS Score:0.09775
    CVSS Score:10

    Affected Products

    Vendor
    Smartertools
    Product
    Smarterstats

    Exploits

    No exploit reference

    Related CVEs

    CVE-2017-14620 (CVSS 6.1) — SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/Referring…
    CVE-2011-4750 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in SmarterTools SmarterStats 6.2.4100 allow remote attacke…
    CVE-2011-4752 (CVSS 10) — SmarterTools SmarterStats 6.2.4100 sends incorrect Content-Type headers for certain resources, which might all…
    CVE-2011-4751 (CVSS 5) — SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests w…
    CVE-2011-2157 (CVSS 5) — The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmGeneralSettings.aspx components in the SmarterTools…
    CVE-2011-2150 (CVSS 5) — The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for stora…
    CVE-2011-2153 (CVSS 5) — Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parame…
    CVE-2011-2159 (CVSS 10) — The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might …
    CVE-2011-2151 (CVSS 5) — The (1) Admin/frmEmailReportSettings.aspx, (2) Admin/frmGeneralSettings.aspx, (3) Admin/frmSite.aspx, (4) Clie…
    CVE-2011-2152 (CVSS 5) — The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High