CVE Feed

    Dashboard / CVE / CVE-2011-3833

    CVE-2011-3833

    Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in an unspecified directory.

    Published:Jan 29, 2012
    Last Modified:Apr 11, 2025
    EPS:Jan 29, 2012
    EPSS Score:0.21003
    CVSS Score:6

    Affected Products

    Vendor
    Sitracker
    Product
    Support Incident Tracker

    Exploits

    http://packetstormsecurity.org/files/106933/sit_file_upload.rb.txthttp://www.exploit-db.com/exploits/18108http://www.securityfocus.com/bid/50632http://www.securityfocus.com/bid/50896http://packetstormsecurity.org/files/106933/sit_file_upload.rb.txthttp://www.exploit-db.com/exploits/18108http://www.securityfocus.com/bid/50632http://www.securityfocus.com/bid/50896https://www.exploit-db.com/exploits/18108

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2019-20220 (CVSS 6.1) — In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is …
    CVE-2019-20221 (CVSS 6.1) — In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS…
    CVE-2019-20222 (CVSS 6.1) — In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.…
    CVE-2019-20223 (CVSS 6.1) — In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this pa…
    CVE-2012-2235 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in Support Incident Tracker (SiT!) 3.65 and earlier allows remote att…
    CVE-2011-5074 (CVSS 6.8) — Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 …
    CVE-2011-4337 (CVSS 7.5) — Static code injection vulnerability in translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 …
    CVE-2011-5072 (CVSS 7.5) — Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attacke…
    CVE-2011-5075 (CVSS 5) — translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to obtain sensi…
    CVE-2011-5073 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow r…

    References

    http://packetstormsecurity.org/files/106933/sit_file_upload.rb.txt
    http://secunia.com/advisories/45453
    http://secunia.com/secunia_research/2011-79/
    http://www.exploit-db.com/exploits/18108
    http://www.kb.cert.org/vuls/id/576355
    http://www.osvdb.org/77003
    http://www.securityfocus.com/bid/50632
    http://www.securityfocus.com/bid/50896
    https://exchange.xforce.ibmcloud.com/vulnerabilities/71237
    https://exchange.xforce.ibmcloud.com/vulnerabilities/71651
    http://packetstormsecurity.org/files/106933/sit_file_upload.rb.txt
    http://secunia.com/advisories/45453
    http://secunia.com/secunia_research/2011-79/
    http://www.exploit-db.com/exploits/18108
    http://www.kb.cert.org/vuls/id/576355
    http://www.osvdb.org/77003
    http://www.securityfocus.com/bid/50632
    http://www.securityfocus.com/bid/50896
    https://exchange.xforce.ibmcloud.com/vulnerabilities/71237
    https://exchange.xforce.ibmcloud.com/vulnerabilities/71651

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High