Description

The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables.

Remediation

References

CVE-2013-0132

Related Vulnerabilities

WordPress Plugin Broken Link Checker Cross-Site Scripting (1.10.8)

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2022-29903)

Joomla! Core Local File Inclusion (2.5.0 - 3.8.8)

WordPress Plugin Apptivo Business Site CRM Multiple Cross-Site Scripting Vulnerabilities (1.2.9)

WordPress Plugin Contact Form, Survey & Popup Form for WordPress-ARForms Form Builder Cross-Site Scripting (1.4)

Severity

Medium

Classification

CVE-2013-0132 CWE-94

Tags

Missing Update Known Vulnerabilities