CVE-2011-5147

Name of the Vulnerable Software and Affected Versions FreeWebshop versions 2.2.9 R2 and earlier

Description A static code injection issue exists in the Ajax File Manager module of the tinymce plugin. This allows remote attackers to inject arbitrary PHP code into data.php via the selected document. The exploitation can be demonstrated by a call to ajax file cut.php and then to ajax save name.php.

Recommendations For FreeWebshop versions 2.2.9 R2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.