CVE-2009-4106

Agoko CMS < 0.4 - Unauthenticated Arbitrary File Upload via admintools/editpage-2.php

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-4106. PoCs published by StAkeR.

AI-analyzed exploit summary This exploit targets Agoko CMS <= 0.4 by injecting a PHP shell via a POST request to 'editpage-2.php'. It then executes arbitrary commands through the uploaded shell.

Description

Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers to inject and execute arbitrary PHP code via the filename and text parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED
by StAkeR · perlwebappsphp
https://www.exploit-db.com/exploits/9605

This exploit targets Agoko CMS <= 0.4 by injecting a PHP shell via a POST request to 'editpage-2.php'. It then executes arbitrary commands through the uploaded shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Agoko CMS <= 0.4
No auth needed
Prerequisites: Target must have Agoko CMS <= 0.4 installed · Target must have the 'admintools/editpage-2.php' endpoint accessible
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/2613
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/53113
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9605

Scores

EPSS 0.0242
EPSS Percentile 82.0%

Details

CWE
CWE-20
Status published
Products (1)
ohloh/agoko_cms < 0.4
Published Nov 29, 2009
Tracked Since Feb 18, 2026