Description
Multiple vendor applications utilize the TinyMCE script. TinyMCE is a platform independent web based Javascript HTML WYSIWYG editor control. This plugin includes a file './plugins/ajaxfilemanager/ajax_create_folder.php' that is vulnerable to remote PHP code execution. The writeInfo() function simply writes all the $_POST content into a file called 'data.php' so an attacker can execute arbitrary PHP code.
Remediation
Upgrade TinyMCE script to the latest version or delete the ajax_create_folder.php if you don't use the AJAX file manager functionality.
References
Related Vulnerabilities
Oracle JRE CVE-2013-0438 Vulnerability (CVE-2013-0438)
IBM RTC Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-7440)
SharePoint CVE-2022-21968 Vulnerability (CVE-2022-21968)
Perl Numeric Errors Vulnerability (CVE-2005-3962)
Apache Tomcat Uncontrolled Resource Consumption Vulnerability (CVE-2019-0199)