CVE-2011-4614: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACKPATH parameter...

Typo3 v4.5-4.7 - Remote Code Execution (RFI/LFI)

No description provided by source. Exploit Title: Typo3 v4.5-4.7 - Remote Code Execution RFI/LFI Date: 4th January 2012 Author: MaXe Software Link: https://typo3.org/download/ Version: 4.5.0 up to 4.5.8, 4.6.0 and 4.6.1 + development releases of 4.7 branch Typo3 v4.5-4.7 - Remote Code Execution...

TYPO3 'AbstractController.php' 'BACK_PATH' Parameter Remote File Inclusion

The version of TYPO3 installed on the remote host fails to sanitize user-supplied input to the 'BACKPATH' parameter of the 'AbstractController.php' script before using it in a PHP 'requireonce' call to include PHP code for execution. Provided that PHP's 'registerglobals' setting is enabled, a...