CVE-2009-2353

eAccelerator - Remote Code Execution via encoder.php -o Option

Title source: manual
STIX 2.1

Description

encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web root via the -o option, and then making a direct request to this file, related to upload of image files.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/504695/100/0/threaded
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2009:188

Scores

EPSS 0.0196
EPSS Percentile 77.9%

Details

CWE
CWE-94
Status published
Products (5)
eaccelerator/eaccelerator 0.9.4
eaccelerator/eaccelerator 0.9.5 (4 CPE variants)
eaccelerator/eaccelerator 0.9.5.1
eaccelerator/eaccelerator 0.9.5.2
eaccelerator/eaccelerator 0.9.5.3
Published Jul 07, 2009
Tracked Since Feb 18, 2026