CVE-2009-3041
EXPLOITED IN THE WILDSPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 - Unauthenticated Unauthorized Access via Install and Backup Endpoints
Title source: llmExploitation Summary
CVE-2009-3041 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit from researchers including Kernel_Panik.
AI-analyzed exploit summary This exploit targets SPIP CMS versions before 2.0.9 by leveraging a directory traversal vulnerability to write arbitrary XML files. It chains multiple requests to extract a hash and save a file in an unintended location.
Description
SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009.
Exploits (1)
This exploit targets SPIP CMS versions before 2.0.9 by leveraging a directory traversal vulnerability to write arbitrary XML files. It chains multiple requests to extract a hash and save a file in an unintended location.