CVE-2009-4098
OpenX < 2.8.1 - Authenticated Arbitrary File Upload and Remote Code Execution via Banner Edit
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-4098.
PoCs published by Metasploit, jduck, including Metasploit module exploits/unix/webapp/openx_banner_edit.
AI-analyzed exploit summary This Metasploit module exploits an authenticated file upload vulnerability in OpenX (CVE-2009-4098) to achieve remote code execution by uploading a malicious PHP file disguised as an image. The exploit leverages the application's failure to properly validate file extensions and image content.
Description
Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upload permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an images directory.
Exploits (2)
This Metasploit module exploits an authenticated file upload vulnerability in OpenX (CVE-2009-4098) to achieve remote code execution by uploading a malicious PHP file disguised as an image. The exploit leverages the application's failure to properly validate file extensions and image content.
This Metasploit module exploits an authenticated file upload vulnerability in OpenX (CVE-2009-4098) to achieve remote code execution by uploading a malicious PHP file disguised as an image. The exploit leverages the application's failure to properly validate file extensions and image content.