Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-4115. PoCs published by rgod.
AI-analyzed exploit summary This exploit targets CVE-2009-4115 in CuteNews 1.4.1, leveraging a shell injection vulnerability to execute arbitrary commands. It injects a PHP shell into 'ipban.db.php' via a malformed request and then triggers command execution through the injected shell.
Description
Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the (1) category and (2) Icon URL fields; or (3) inject arbitrary PHP code into data/ipban.php via the add_ip parameter.
Exploits (1)
This exploit targets CVE-2009-4115 in CuteNews 1.4.1, leveraging a shell injection vulnerability to execute arbitrary commands. It injects a PHP shell into 'ipban.db.php' via a malformed request and then triggers command execution through the injected shell.