PT-2012-1930

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.x through 4.5.8 TYPO3 versions 4.6.x through 4.6.1 TYPO3 development versions of 4.7 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the BACK PATH parameter. This is a result of a PHP...

CVE-2011-4614: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACKPATH parameter...

Typo3 v4.5-4.7 - Remote Code Execution (RFI/LFI)

No description provided by source. Exploit Title: Typo3 v4.5-4.7 - Remote Code Execution RFI/LFI Date: 4th January 2012 Author: MaXe Software Link: https://typo3.org/download/ Version: 4.5.0 up to 4.5.8, 4.6.0 and 4.6.1 + development releases of 4.7 branch Typo3 v4.5-4.7 - Remote Code Execution...

TYPO3 'AbstractController.php' 'BACK_PATH' Parameter Remote File Inclusion

The version of TYPO3 installed on the remote host fails to sanitize user-supplied input to the 'BACKPATH' parameter of the 'AbstractController.php' script before using it in a PHP 'requireonce' call to include PHP code for execution. Provided that PHP's 'registerglobals' setting is enabled, a...