CVE-2009-3171

Anantasoft Gazelle CMS < 1.0 - Cross-Site Scripting via User or Lookup Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-3171. PoCs published by IHTeam.

AI-analyzed exploit summary This script exploits multiple vulnerabilities in Gazelle CMS 1.0, including RCE via file upload, LFI, and XSS. It uploads a malicious PHP file via a template customization feature and provides a shell interface for command execution.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user parameter to user.php or (2) lookup parameter to search.php.

Exploits (1)

exploitdb WORKING POC VERIFIED
by IHTeam · bashwebappsphp
https://www.exploit-db.com/exploits/9425

This script exploits multiple vulnerabilities in Gazelle CMS 1.0, including RCE via file upload, LFI, and XSS. It uploads a malicious PHP file via a template customization feature and provides a shell interface for command execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Gazelle CMS 1.0
No auth needed
Prerequisites: magic_quotes_gpc Off · access to admin/settemplate.php
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9425
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/2541
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33686
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/52415

Scores

EPSS 0.0153
EPSS Percentile 71.4%

Details

CWE
CWE-79
Status published
Products (1)
anantasoft/gazelle_cms < 1.0
Published Sep 11, 2009
Tracked Since Feb 18, 2026