CVE-2011-2261

Related Files

Zero Day Initiative Advisory 11-238

Posted Jul 21, 2011

Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 11-238 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Secure Backup. Authentication is not required to exploit this vulnerability. The specific flaw exists within the validate_login function defined within /apache/htdocts/php/common.php. The username parameter is passed with limited sanitization to an exec_qr call which can be abused to inject commands. The sanitation that does occur can limit the exploitation of this issue, however code execution can likely still be achieved. Successful attempts will yield remote code execution under the context of the apache server.

tags | advisory, remote, arbitrary, php, code execution

advisories | CVE-2011-2261

SHA-256 | 8abe40785b4a1142c75a2394d5b25258bae169d31e77a2db6b90b719ce3703cf

Download | Favorite | View