CVE-2013-5352

EUVD-2013-5192
Sharetronix 3.1.1.3, 3.1.1, and earlier allows remote attackers to execute arbitrary PHP code via the (1) activities_text parameter to services/activities/set or (2) comments_text parameter to services/comments/set, which is not properly handled when executing the preg_replace function with the e modifier.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
sharetronixsharetronix
𝑥
≤ 3.1.1
sharetronixsharetronix
3.1.1.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/100605
http://secunia.com/advisories/53936
http://secunia.com/secunia_research/2013-8/
http://www.osvdb.org/100606
http://www.securityfocus.com/bid/64102
https://exchange.xforce.ibmcloud.com/vulnerabilities/89503
http://osvdb.org/100605
http://secunia.com/advisories/53936
http://secunia.com/secunia_research/2013-8/
http://www.osvdb.org/100606
http://www.securityfocus.com/bid/64102
https://exchange.xforce.ibmcloud.com/vulnerabilities/89503