CVE-2011-2933

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
WebsiteBaker	WebsiteBaker	through 2.8.1

References

https://www.openwall.com/lists/oss-security/2011/08/19/12Exploit, Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/08/19/12Exploit, Mailing List, Third Party Advisory

Timeline

Published: Jan 14, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-29348.8A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate CVE-2011-29356.1Elgg through 1.7.10 has XSS CVE-2011-29369.8Elgg through 1.7.10 has a SQL injection vulnerability CVE-2011-29374.3Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to injec CVE-2011-29384.3Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary we CVE-2011-29395.1Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allo CVE-2011-29409.3stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspe CVE-2011-29415.8Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allows remote attackers to redirect users to arbitrary CVE-2011-29426.8A certain Red Hat patch to the __br_deliver function in net/bridge/br_forward.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL CVE-2011-29434.3The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly val CVE-2011-29447.5SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via CVE-2011-29459.3Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows