{"id":"CVE-2011-4075","aliases":["DEBIAN-CVE-2011-4075","DSA-2333-1","EUVD-2011-4027","GHSA-5h4f-2c6r-8cj3"],"status":"published","title":"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote...","description":"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.51891,"percentile":0.98959,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2011-10-31T00:00:00Z","modified":"2026-10-23T17:47:33Z","exploits":[{"source":"exploitdb","id":"EDB-18021","title":"phpLDAPadmin 1.2.1.1 - Remote PHP Code Injection (1)","type":"webapps","platform":"php","date":"2011-10-23","verified":true,"url":"https://www.exploit-db.com/exploits/18021"},{"source":"metasploit","id":"exploit/multi/http/phpldapadmin_query_engine","title":"phpLDAPadmin query_engine Remote PHP Code Injection","type":"exploit","platform":"PHP","date":"2011-10-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/phpldapadmin_query_engine"},{"source":"exploitdb","id":"EDB-18031","title":"phpLDAPadmin 1.2.1.1 - Remote PHP Code Injection (Metasploit) (2)","type":"webapps","platform":"php","date":"2011-10-25","verified":true,"url":"https://www.exploit-db.com/exploits/18031"}],"fixes":[{"ecosystem":"Debian:12","package":"phpldapadmin","fixed_in":["1.2.0.5-2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpldapadmin","fixed_in":["1.2.0.5-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpldapadmin","fixed_in":["1.2.0.5-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0.5-2.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0.5-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0.5-2.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0.5-2+squeeze1"}]}],"versions":["1.2.0.5-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:5.0","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0.5-6+lenny2"}]}],"versions":["1.1.0.5-6","1.1.0.5-6+lenny1"],"bundled":2}],"products":[{"vendor":"phpldapadmin_project","product":"phpldapadmin"}],"references":[{"url":"http://sourceforge.net/tracker/index.php?func=detail\u0026aid=3417184\u0026group_id=61828\u0026atid=498546","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://osvdb.org/76594","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/50331","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2011/10/25/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://www.exploit-db.com/exploits/18021/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","evidence"]},{"url":"http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin%3Ba=blobdiff%3Bf=lib/functions.php%3Bh=eb160dc9f7d74e563131e21d4c85d7849a0c6638%3Bhp=19fde9974d4e5eb3bfac04bb223ccbefdb98f9a0%3Bhb=76e6dad13ef77c5448b8dfed1a61e4acc7241165%3Bhpb=5d4245f93ae6f065e7535f268e3cd87a23b07744","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://dev.metasploit.com/redmine/issues/5820","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://secunia.com/advisories/46672","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/46551","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://openwall.com/lists/oss-security/2011/10/24/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2011/dsa-2333","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4075"},{"url":"http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;a=blobdiff;f=lib/functions.php;h=eb160dc9f7d74e563131e21d4c85d7849a0c6638;hp=19fde9974d4e5eb3bfac04bb223ccbefdb98f9a0;hb=76e6dad13ef77c5448b8dfed1a61e4acc7241165;hpb=5d4245f93ae6f065e7535f268e3cd87a23b07744"},{"url":"http://www.exploit-db.com/exploits/18021"},{"url":"https://github.com/advisories/GHSA-5h4f-2c6r-8cj3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-4075","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-4075","description":"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.","status":"published","published":"2011-11-02T17:00:00Z","modified":"2024-08-06T23:53:32.825Z","updated_at":"2026-11-02T14:35:37.671707Z"}],"euvd":[{"id":"EUVD-2011-4027","description":"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.","status":"published","published":"2011-11-02T17:00:00Z","modified":"2024-08-06T23:53:32Z","updated_at":"2026-11-03T01:39:49.868954Z"}],"ghsa":[{"id":"GHSA-5h4f-2c6r-8cj3","title":"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote...","description":"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.","status":"published","published":"2022-05-13T01:13:46Z","modified":"2025-04-11T03:52:35Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:01:09.612717Z"}],"nvd":[{"id":"CVE-2011-4075","description":"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.","status":"published","published":"2011-11-02T17:55:01.387Z","modified":"2026-06-16T23:34:22.8Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:10.769216Z"}],"osv":[{"id":"CVE-2011-4075","description":"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.","status":"published","published":"2011-11-02T17:55:01Z","modified":"2026-04-10T03:42:01.158266Z","updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-4075","description":"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.","status":"published","published":"2011-11-02T17:55:01.387Z","modified":"2026-10-23T17:47:33.289972578Z","updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"DSA-2333-1","title":"phpldapadmin - several issues","status":"published","published":"2011-10-31T00:00:00Z","modified":"2026-03-09T01:17:59.538511Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}