CVE-2011-3829

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 18%

from disclosure to weapon0 days

Published on NVDJan 29

1st PoCNov 13

metasploitNov 10

exploitation probability

18%top 3% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.org/files/106933/sit_file_upload.rb.txtunverified cve_referencewww.exploit-db.com/exploits/18108unverified exploitdbwww.exploit-db.com/exploits/18108unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.org/files/106933/sit_file_upload.rb.txt http://secunia.com/advisories/45453 http://secunia.com/secunia_research/2011-75/https://exchange.xforce.ibmcloud.com/vulnerabilities/71233 http://www.exploit-db.com/exploits/18108 http://www.osvdb.org/76999 http://www.securityfocus.com/bid/50632