CVE-2011-5148

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

4.88%

Published

Aug 31, 2012

Modified

Apr 28, 2026

Public PoC / Exploit (2)

All weaponized →

Exploit-DBJoomla! Component Module Simple File Upload 1.3 - Remote Code Execution TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple incomplete blacklist vulnerabilities in the Simple File Upload (mod_simplefileuploadv1.3) module before 1.3.5 for Joomla! allow remote attackers to execute arbitrary code by uploading a file with a (1) php5, (2) php6, or (3) double (e.g. .php.jpg) extension, then accessing it via a direct request to the file in images/, as exploited in the wild in January 2012.

Affected Products (4)

wasen · mod_simplefileuploadvulnerable

joomla · joomla\!

References (16)

http://docs.joomla.org/Vulnerable_Extensions_List#Simple_File_Upload_1.3

http://secunia.com/advisories/47370

Vendor Advisory

http://wasen.net/index.php?option=com_content&view=article&id=87&Itemid=59

http://www.exploit-db.com/exploits/18287

http://www.osvdb.org/78122

http://www.securityfocus.com/bid/51214

http://www.securityfocus.com/bid/51234