CVE-2009-1209

W3C Amaya Web Browser 11.1 - Remote Code Execution via Long Defer Attribute in Script Tag

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2009-1209. PoCs published by His0k4, Encrypt3d.M!nd, Alfons Luja.

AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in Amaya 11.2 via a crafted HTML file with a 'defer' attribute. It uses SEH overwriting and shellcode execution to achieve remote code execution (RCE).

Description

Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script tag with a long defer attribute.

Exploits (3)

exploitdb WORKING POC VERIFIED
by His0k4 · pythonremotewindows
https://www.exploit-db.com/exploits/9330

This exploit targets a buffer overflow vulnerability in Amaya 11.2 via a crafted HTML file with a 'defer' attribute. It uses SEH overwriting and shellcode execution to achieve remote code execution (RCE).

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Amaya 11.2 W3C Editor/Browser
No auth needed
Prerequisites: Victim must open the crafted HTML file from a webserver
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Encrypt3d.M!nd · pythonremotewindows
https://www.exploit-db.com/exploits/8321

This exploit targets a stack overflow vulnerability in Amaya 11.1 via a maliciously crafted HTML file with a long 'defer' attribute. It uses a combination of NOP sleds and shellcode to achieve remote code execution, specifically launching calc.exe via Metasploit-generated payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Amaya 11.1 W3C Editor/Browser
No auth needed
Prerequisites: Victim must open the crafted HTML file in Amaya 11.1 · Windows XP SP2 environment
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Alfons Luja · phpdoswindows
https://www.exploit-db.com/exploits/8314

This exploit demonstrates a stack overflow vulnerability in Amaya 11.1 by overwriting the SEH handler. It generates a malicious HTML file that triggers the overflow when processed by the vulnerable software.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Amaya 11.1
No auth needed
Prerequisites: Vulnerable version of Amaya installed · Ability to deliver the malicious HTML file to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0889
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/8314
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/8321
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34531
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/47399
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34295

Scores

EPSS 0.1237
EPSS Percentile 95.7%

Details

CWE
CWE-119
Status published
Products (1)
w3/amaya 11.1
Published Apr 01, 2009
Tracked Since Feb 18, 2026