CVE-2011-10011

CVE-2011-10011 describes a critical remote code injection vulnerability in WeBid 1.0.2, specifically within the converter.php script. Unauthenticated attackers can inject arbitrary PHP code into includes/currencies.php by manipulating the 'to' parameter in a POST request due to a lack of input sanitization. This flaw carries a CVSS score of 10.0 (CRITICAL) due to its network-based attack vector, low attack complexity, and high potential for complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, a Metasploit module exists for this vulnerability, and it has garnered significant community discussion, indicating readily available exploit code and awareness among threat actors.