CVE-2009-3716

MCshoutbox 1.1 - Authenticated Arbitrary File Upload via Admin Panel

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-3716. PoCs published by SirGod.

AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in MCshoutbox 1.1, including SQL injection for authentication bypass, XSS via the 'loginerror' parameter, and unrestricted file upload leading to remote shell execution. The PoC includes specific payloads and vulnerable code snippets.

Description

Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in smilies/.

Exploits (1)

exploitdb WORKING POC VERIFIED
by SirGod · textwebappsphp
https://www.exploit-db.com/exploits/9205

The exploit demonstrates multiple vulnerabilities in MCshoutbox 1.1, including SQL injection for authentication bypass, XSS via the 'loginerror' parameter, and unrestricted file upload leading to remote shell execution. The PoC includes specific payloads and vulnerable code snippets.

Classification
Working Poc 95%
Attack Type
Sqli | Xss | Rce
Complexity
Trivial
Reliability
Reliable
Target: MCshoutbox 1.1
No auth needed
Prerequisites: magic_quotes_gpc = off · access to admin_login.php and admin.php
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9205
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/56064
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35885
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/51864

Scores

EPSS 0.0357
EPSS Percentile 87.9%

Details

CWE
CWE-264
Status published
Products (1)
maniacomputer/mcshoutbox 1.1
Published Oct 16, 2009
Tracked Since Feb 18, 2026