CVE-2011-4075: phpLDAPadmin masort function PHP code injection via orderby parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution in a network-exposed administrative tool, with in-the-wild exploitation reported and a very high EPSS score.

What it is

The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 fails to safely handle the orderby (sortby) parameter, allowing remote attackers to inject and execute arbitrary PHP code through a query_engine action to cmd.php. This is a code injection flaw in a web-facing LDAP administration tool, and the record states it was exploited in the wild in October 2011.

Impact

An attacker can execute arbitrary PHP code on the phpLDAPadmin server, which typically leads to full compromise of the web application and its underlying host. Because phpLDAPadmin holds directory credentials, the attacker may also gain access to the LDAP directory it manages.

Attack surface

Reachable over the network via HTTP requests to cmd.php with a crafted orderby parameter in a query_engine action. The CVSS vector AV:N/AC:L/Au:N indicates no authentication is required and no user interaction is needed.

Exploitation

The record states the flaw was exploited in the wild in October 2011, and multiple references are tagged Exploit, including Exploit-DB and Metasploit issue trackers. It is not listed in CISA KEV, but EPSS is high at 0.51891 (98.9th percentile).

What to do

• Upgrade phpLDAPadmin to 1.2.2 or later, which contains the fix for the masort function.
• If immediate upgrade is not possible, restrict network access to phpLDAPadmin so only trusted administrative hosts can reach cmd.php.
• Apply the vendor patch referenced in the openwall and git diff links if a package update is unavailable.
• Run phpLDAPadmin with least privilege and avoid using directory administrator credentials for the web application.
• Monitor for and block requests to cmd.php containing suspicious orderby or sortby parameter values.

Detection

• Inspect web server logs for requests to cmd.php with query_engine action and unusual orderby or sortby parameters.
• Look for PHP code execution indicators in phpLDAPadmin process behavior, such as unexpected child processes or outbound connections.
• Use the available Exploit-DB and Metasploit references to build signatures for known exploit payloads against cmd.php.
• Review file integrity of lib/functions.php and other phpLDAPadmin files for unauthorized modification.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.