SB2011102601 - Fedora EPEL 6 update for phpldapadmin

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2011102601

SB2011102601 - Fedora EPEL 6 update for phpldapadmin

Published: October 26, 2011 Updated: April 24, 2025

Security Bulletin ID SB2011102601
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2011-4074)

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in cmd.php in phpLDAPadmin 1.2.x before 1.2.2. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


2) Code injection (CVE-ID: CVE-2011-4075)

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to absent sanitization in the "lib/functions.php" script when processing use-supplied input passed via "orderby" HTTP POST parameter to "/cmd.php" script. A remote attacker can send a specially crafted HTTP POST request to vulnerable script, inject and execute arbitrary PHP code on the target system with privileges of the web server.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability was being actively exploited.


Remediation

Install update from vendor's website.

References