CVE

Id
41575  
CVE No.
CVE-2009-4140  
Status
Candidate  
Description
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.  
Phase
Assigned (20091201)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
456675 41575 CVE-2009-4140 EXPLOIT-DB:24969  View
456676 41575 CVE-2009-4140 URL:http://www.exploit-db.com/exploits/24969  View
456677 41575 CVE-2009-4140 MLIST:[oss-security] 20091214 CVE Request - Open Flash Chart v2  View
456678 41575 CVE-2009-4140 URL:http://www.openwall.com/lists/oss-security/2009/12/14/1  View
456679 41575 CVE-2009-4140 MLIST:[oss-security] 20091214 Re: CVE Request - Open Flash Chart v2  View
456680 41575 CVE-2009-4140 URL:http://www.openwall.com/lists/oss-security/2009/12/14/3  View
456681 41575 CVE-2009-4140 MISC:http://packetstormsecurity.org/0910-exploits/piwik-upload.txt  View
456682 41575 CVE-2009-4140 MISC:http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt  View
456683 41575 CVE-2009-4140 MISC:http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt  View
456684 41575 CVE-2009-4140 CONFIRM:http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/  View
456685 41575 CVE-2009-4140 CONFIRM:http://wordpress.org/extend/plugins/woopra/changelog/  View
456686 41575 CVE-2009-4140 BID:37314  View
456687 41575 CVE-2009-4140 URL:http://www.securityfocus.com/bid/37314  View
456688 41575 CVE-2009-4140 OSVDB:59051  View
456689 41575 CVE-2009-4140 URL:http://www.osvdb.org/59051  View
456690 41575 CVE-2009-4140 SECUNIA:37078  View
456691 41575 CVE-2009-4140 URL:http://secunia.com/advisories/37078  View
456692 41575 CVE-2009-4140 SECUNIA:37911  View
456693 41575 CVE-2009-4140 URL:http://secunia.com/advisories/37911  View
456694 41575 CVE-2009-4140 SECUNIA:55160  View
456695 41575 CVE-2009-4140 URL:http://secunia.com/advisories/55160  View
456696 41575 CVE-2009-4140 SECUNIA:55162  View
456697 41575 CVE-2009-4140 URL:http://secunia.com/advisories/55162  View
456698 41575 CVE-2009-4140 VUPEN:ADV-2009-2966  View
456699 41575 CVE-2009-4140 URL:http://www.vupen.com/english/advisories/2009/2966  View
456700 41575 CVE-2009-4140 XF:piwik-ofcuploadimage-code-execution(53825)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
41502 JVNDB-2009-002509 NetworkManager における重要な情報を取得される脆弱性 NetworkManager には、WPA Enterprise または 802.1x ネットワーク用に設定された CA 証明書ファイルの取り扱いに不備があるため、重要な情報を取得される、またはサービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2009-4144 41575 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002509.html  View