# CVE-2017-11107: PhpLDAPadmin - XSS

> Live exploitation tracking for CVE-2017-11107 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2017-11107

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.1
- **Public exploit available:** Yes
- **Affected products:** PhpLDAPadmin
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- **Tags:** php, management_panel

## Description

PhpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.php via the form, element, rdn, or container parameter.

## CrowdSec analysis

[CVE-2017-11107](https://euvd.enisa.europa.eu/vulnerability/CVE-2017-11107) is a cross-site scripting (XSS) vulnerability in phpLDAPadmin up to version 1.2.3, specifically in the entry_chooser.php file via several parameters. This flaw could allow remote attackers to inject malicious scripts, potentially leading to session hijacking or the theft of sensitive information from users interacting with the application.

CrowdSec has been tracking this vulnerability and its exploits since 14th of January 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2017-11107 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending crafted requests to `/phpldapadmin/entry_chooser.php` with malicious JavaScript payloads in parameters such as `container`, leading to reflected XSS in victim browsers.

## Timeline

- 2017-07-08: CVE Published. CVE-2017-11107 is published to NVD.
- 2026-01-14: Rule Released. CrowdSec releases a rule to detect CVE-2017-11107 exploitation attempts against the CrowdSec Network.
- 2026-05-01: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2017-11107 for the first time.

## References

- https://bugs.launchpad.net/ubuntu/+source/phpldapadmin/+bug/1701731
- https://github.com/leenooks/phpLDAPadmin/issues/50
- https://lists.debian.org/debian-lts-announce/2018/10/msg00023.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11107.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2017-11107) follows observed exploitation activity for CVE-2017-11107. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.