CVE-2009-20011

CRITICAL

ContentKeeper Web Appliance <125.10 - RCE

Title source: llm

Description

ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, resulting in root-level access if successful.

Exploits (1)

metasploit WORKING POC EXCELLENT

by aushack · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/contentkeeperweb_mimencode.rb

View Code ZIP pw:eip

References (5)

[Various Sources] http://www.aushack.com/200904-contentkeeper.txt

[Various Sources] https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/contentkeeperweb_mimencode.rb

[Various Sources] https://web.archive.org/web/20081220084819/http://www.contentkeeper.com/

[Various Sources] https://www.ativion.com/contentkeeper/

[Third Party Advisory] https://www.vulncheck.com/advisories/contentkeeper-web-appliance-rce-via-mimencode

Scores

CVSS v4 10.0

EPSS 0.6044

EPSS Percentile 98.3%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Details

CWE

CWE-434 CWE-78

Status published

Products (1)

ContentKeeper Technologies/ContentKeeper Web Appliance < 125.10

Published Aug 30, 2025

Tracked Since Feb 18, 2026