CVE-2011-10011 Details
Description
WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remote code execution when the modified script is accessed or included by the application.
A remote code injection vulnerability has been identified in WeBid version 1.0.2, specifically within the 'converter.php' script. The issue arises from unsanitized input in the 'to' parameter of a POST request, which is directly written into 'includes/currencies.php'. This vulnerability allows unauthenticated attackers to inject arbitrary PHP code, leading to persistent remote code execution when the modified script is accessed or included by the application.
Users are advised to update to WeBid version 1.2.1, which addresses this vulnerability. The update can be downloaded from the WeBid SourceForge page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 13, 2025CISA-ADP
Assessed Aug 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/webid_converter.rb | CISA-ADP | ExploitSource Code |
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/webid_converter.rb | [email protected] | ExploitSource Code |
| https://sourceforge.net/projects/simpleauction/ | [email protected] | ProductVendor |
| https://web.archive.org/web/20121024110058/http://www.webidsupport.com/forums/showthread.php?3892 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://www.exploit-db.com/exploits/17487 | [email protected] | Exploit |
| https://www.exploit-db.com/exploits/18934 | [email protected] | Exploit |
| https://www.vulncheck.com/advisories/webid-remote-php-code-injection | [email protected] | AdvisoryBundleExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WeBid | <= 1.0.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 16, 2026 | CVE Modified | [email protected] |
| Jun 16, 2026 | CVE Modified | CISA-ADP |
| Aug 14, 2025 | CVE Modified | CISA-ADP |
| Aug 13, 2025 | New CVE Received | [email protected] |