CVE-2009-20011

ContentKeeper Web Appliance <125.10 - RCE

Title source: llm

Description

ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, resulting in root-level access if successful.

Exploits (1)

metasploit WORKING POC EXCELLENT

by aushack · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/contentkeeperweb_mimencode.rb

View Code ZIP pw:eip

References (5)

[Various Sources] http://www.aushack.com/200904-contentkeeper.txt

[Various Sources] https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/contentkeeperweb_mimencode.rb

[Various Sources] https://web.archive.org/web/20081220084819/http://www.contentkeeper.com/

[Various Sources] https://www.ativion.com/contentkeeper/

[Third Party Advisory] https://www.vulncheck.com/advisories/contentkeeper-web-appliance-rce-via-mimencode

Scores

EPSS 0.6044

EPSS Percentile 98.2%

Classification

CWE

CWE-78 CWE-434

Status draft

Timeline

Published Aug 30, 2025

Tracked Since Feb 18, 2026