CVE-2011-5067: move_uploaded_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obt...

Security readout for executives and security teams

This CVE describes an information disclosure bug in Support Incident Tracker (SiT!) 3.65. An authenticated remote user can trigger an error that exposes the server installation path through the supplied file name. That path alone is usually not a business-impacting compromise, but it can help an attacker map the application environment. Exposure is limited to organizations still running SiT! 3.65 where authenticated users can reach move_uploaded_file.php and see detailed error messages. Public internet exposure is not stated in the sources. Low priority for most environments, but address during normal remediation if SiT! 3.65 exists. Path disclosure can support follow-on attacks, especially when combined with other weaknesses, but the supplied sources do not indicate active exploitation or direct compromise. Mitigation focus: Identify any remaining SiT! 3.65 deployments.; Check vendor or project guidance for an official fix or upgrade path.; Disable detailed PHP error display in production..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.