CVE-2011-5130 — AI Deep Analysis Summary

🚨 **Essence**: Arbitrary Code Execution in `dev/less.php`. 📉 **Consequences**: Remote attackers can execute shell commands via `argv[1]`. 💥 **Impact**: Full system compromise possible if `register_globals` is on.

🛡️ **Root Cause**: Improper input validation in `dev/less.php`. 🐛 **Flaw**: Reliance on `register_globals` (deprecated PHP setting). 📝 **CWE**: Not specified in data, but classic **Injection** flaw.

🎯 **Target**: Family Connections CMS (FCMS). 📦 **Versions**: 2.5.0 through 2.7.1. ⚠️ **Component**: Specifically the `dev/less.php` script.

🔓 **Privileges**: Remote Code Execution (RCE). 🗑️ **Data**: Potential full server control. 🛠️ **Action**: Inject shell meta-characters via `argv[1]` to run arbitrary commands.

⚙️ **Config Dependency**: HIGH. Requires `register_globals` to be **ENABLED**. 🔓 **Auth**: Remote exploitation (no login required for the vector).…

💣 **Public Exploit**: YES. 📚 **References**: Exploit-DB #18208 & #18198. 🌐 **Status**: Wild exploitation possible via X-Force Exchange (ID 71618).

🔍 **Check**: Scan for `dev/less.php` endpoint. 🧪 **Test**: Inject shell characters into `argv[1]`. 📊 **Tool**: Use Exploit-DB scripts to verify RCE capability. 🚩 **Flag**: Look for PHP `register_globals` enabled.

🛠️ **Official Fix**: YES. 📢 **Source**: Family CMS Blog & SourceForge Ticket #407. 📅 **Date**: Confirmed in Nov 2011. ✅ **Action**: Update to patched version.

🚫 **Workaround**: Disable `register_globals` in `php.ini`. 🧱 **Defense**: Block access to `dev/less.php` via WAF or `.htaccess`. 🛡️ **Mitigation**: Input sanitization if code cannot be changed immediately.

🔥 **Urgency**: HIGH for legacy systems. 📉 **Priority**: Critical if `register_globals` is on. 📅 **Context**: Old CVE (2011), but dangerous if unpatched legacy CMS is still running.…