CVE-2009-3181

Anantasoft Gazelle CMS 1.0 - Path Traversal and Arbitrary File Write via Customize Template Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-3181. PoCs published by IHTeam.

AI-analyzed exploit summary This script exploits multiple vulnerabilities in Gazelle CMS 1.0, including RCE via file upload, LFI, and XSS. It uploads a malicious PHP file via a template customization feature and provides a shell interface for command execution.

Description

Directory traversal vulnerability in Anantasoft Gazelle CMS 1.0 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the customizetemplate parameter in a direct request to admin/settemplate.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by IHTeam · bashwebappsphp

https://www.exploit-db.com/exploits/9425

View Code ZIP pw:eip

This script exploits multiple vulnerabilities in Gazelle CMS 1.0, including RCE via file upload, LFI, and XSS. It uploads a malicious PHP file via a template customization feature and provides a shell interface for command execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Gazelle CMS 1.0

No auth needed

Prerequisites: magic_quotes_gpc Off · access to admin/settemplate.php

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/9425

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33686

Scores

EPSS 0.0204

EPSS Percentile 78.7%

Details

CWE

CWE-22

Status published

Products (1)

anantasoft/gazelle_cms 1.0

Published Sep 11, 2009

Tracked Since Feb 18, 2026