CVE-2009-4017

PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-4017 has a selected CVSS score of 5.0; EIP currently links 1 catalogued exploit.

Description

PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBPHP < 5.3.1 - 'MultiPart/form-data' Denial of ServiceExploitDB exploitby ErenExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends crafted multipart/form-data POST requests with 16,000 file parts to exhaust temporary files on a PHP server, causing denial of service.

Backdoor review

No backdoor observed in reviewed code

The supplied Python script is a straightforward denial-of-service (DoS) exploit targeting PHP multipart/form-data temporary file exhaustion. It opens multiple TCP connections and sends crafted HTTP POST requests with 16,000 form-data parts. No backdoor, trojan, or deceptive behavior is present. The code performs only the advertised DoS attack and contains no concealed executable payloads, persistence mechanisms, credential theft, or unrelated remote access.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwarephp
Attack typesdenial of service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends malicious HTTP requests designed to exhaust server resources, which is the definition of an exploit. It does not merely check for vulnerability presence.

exploits/php/dos/10242.py:12-14exploits/php/dos/10242.py:110-116

Requirements

  • Target must run a vulnerable PHP version (before 5.2.12 or 5.3.x before 5.3.1) that does not restrict temporary file creation for multipart/form-data requests.exploits/php/dos/10242.py:19-20
  • Attacker must be able to establish TCP connections to the target web server port.exploits/php/dos/10242.py:63-64

Observed behavior

  • Accepts target host, port, path, and optional thread count from command line.exploits/php/dos/10242.py:140-147
  • Spawns multiple threads, each sending 10 HTTP POST requests with a multipart/form-data body containing 16,000 file parts.exploits/php/dos/10242.py:100-104exploits/php/dos/10242.py:110-116exploits/php/dos/10242.py:149-152
  • Each request causes the PHP server to create a temporary file for each file part, exhausting disk space or inode resources.exploits/php/dos/10242.py:12-14
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

DoS Mechanism
Payload withheldThis is the advertised exploit behavior for CVE-2009-4017.exploits/php/dos/10242.py:100-104
Network Connection
Payload withheldRequired for sending the DoS payload; no unexpected outbound connections.exploits/php/dos/10242.py:62-64
Threading
Payload withheldStandard concurrency for DoS amplification; no hidden functionality.exploits/php/dos/10242.py:75-80
Review boundaries

What the analysis did not establish

  • Only the Python script source is analyzed; no external libraries, network captures, or execution logs are provided.
  • The script contains a logic error: sys.exit(0) inside the for loop in run() will terminate the thread after the first request, limiting the intended 10 requests per thread to 1.
  • Only the single Python file was reviewed; no external dependencies or referenced resources were inspected.
  • Binary files were flagged as metadata-only and not analyzed, but none were present in this artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

Showing 12 of 26