CVE-2011-4337 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 2.4% (pctl 83)
Patch early
A public exploit exists.
Description
Static code injection vulnerability in translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 2.37% — more likely to be exploited than 83% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2012-01-29 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| sitracker | support incident tracker |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Support Incident Tracker 3.65 - 'translate.php' Remote Code Execution | 2011-11-19 |
References
- http://bugs.sitracker.org/view.php?id=1737
- http://www.exploit-db.com/exploits/18132/
- http://www.openwall.com/lists/oss-security/2011/11/22/3
- http://www.securityfocus.com/archive/1/520577
- http://bugs.sitracker.org/view.php?id=1737
- http://www.exploit-db.com/exploits/18132/
- http://www.openwall.com/lists/oss-security/2011/11/22/3
- http://www.securityfocus.com/archive/1/520577
→ the Explorer · watch your stack · NVD