CVE-2013-4211: OpenX Ad Server backdoor in flowplayer library allows PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, public exploit code and a very high EPSS score make this an urgent risk for any host still running the affected version.

What it is

OpenX Ad Server 2.8.10 ships a backdoored flowplayer-3.1.1.min.js library that permits remote arbitrary PHP code execution. The flaw is a code injection (CWE-94) reachable over the network without authentication, and it carries a critical CVSS 3.1 score of 9.8. Because the malicious code is embedded in a distributed library file, any deployment of the affected version is exposed.

Impact

An unauthenticated remote attacker can execute arbitrary PHP code on the server, leading to full compromise of the web application and its data. Given the CVSS impact ratings of high for confidentiality, integrity and availability, the attacker can read, modify or destroy anything the web server process can reach.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), per the CVSS vector. The backdoor resides in the flowplayer-3.1.1.min.js library bundled with OpenX Ad Server 2.8.10, so exploitation targets the server hosting that file.

Exploitation

Public exploit code exists, as indicated by Exploit and Exploit-DB tags in the references, and EPSS gives a 30-day probability of 0.70653 (99.36th percentile). CISA KEV does not list this CVE, so there is no confirmed in-the-wild exploitation record from that source.

What to do

• Upgrade or replace OpenX Ad Server 2.8.10 with a supported, non-backdoored release; if no fixed version exists, retire the product.
• Remove or replace the bundled flowplayer-3.1.1.min.js file and verify the integrity of all third-party JavaScript libraries against known-good hashes.
• Isolate any remaining OpenX instance behind a reverse proxy or WAF and restrict outbound network access from the web server.
• Audit the web server for unexpected PHP files, webshells and modified library files, and restore from a trusted baseline.
• Rotate credentials and secrets accessible to the OpenX application and its database.

Detection

• Search the web root for flowplayer-3.1.1.min.js and compare its hash against the official upstream release.
• Monitor web server logs for requests to flowplayer-3.1.1.min.js followed by unusual POST or GET parameters that could trigger PHP execution.
• Hunt for newly created or modified PHP files in web-accessible directories, especially webshell-like patterns.
• Alert on outbound connections from the OpenX host to unfamiliar IPs or domains, which may indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.