CVE-2011-2944

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 2.7%

from disclosure to weapon0 days

Published on NVDAug 12

1st PoCFeb 23

exploitation probability

2.7%top 16% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/18518unverified cve_referencepacketstormsecurity.org/files/110166/The-Uploader-2.0.4-Eng-Ita-Remote-File-Upload.htmlunverified cve_referencewww.exploit-db.com/exploits/18518unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://osvdb.org/79508 http://packetstormsecurity.org/files/110166/The-Uploader-2.0.4-Eng-Ita-Remote-File-Upload.html http://secunia.com/advisories/48141 https://exchange.xforce.ibmcloud.com/vulnerabilities/73471 http://sourceforge.net/p/theuploader/news/2011/07/the-uploader-205-released http://www.exploit-db.com/exploits/18518 http://www.securityfocus.com/bid/52156