CVE-2009-4140
EXPLOITEDOpen Flash Chart v2 Beta 1-v2 Lug Wyrm Charmer - RCE
Title source: llmExploitation Summary
CVE-2009-4140 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 8 public exploits from researchers including iskorpitx, Braeden Thomas, including a Metasploit module exploits/unix/webapp/openemr_upload_exec.
AI-analyzed exploit summary This exploit targets a remote code injection vulnerability in Joomla's com_civicrm component (CVE-2011-4275). It uploads a malicious PHP file via the ofc_upload_image.php script, which then executes arbitrary commands to fetch and deploy a shell.
Description
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
Exploits (8)
This exploit targets a remote code injection vulnerability in Joomla's com_civicrm component (CVE-2011-4275). It uploads a malicious PHP file via the ofc_upload_image.php script, which then executes arbitrary commands to fetch and deploy a shell.
This exploit demonstrates a remote code execution (RCE) vulnerability in ZonPHP v2.25 by uploading a malicious PHP file via the 'ofc_upload_image.php' endpoint. The script uses cURL to send a POST request with a PHP payload, which is then accessible on the target server.
The exploit demonstrates a remote code execution vulnerability in Open Flash Chart due to improper input sanitization. The provided URI example shows how arbitrary PHP code can be executed via the 'name' and 'HTTP_RAW_POST_DATA' parameters.
This PHP script exploits an arbitrary file upload vulnerability in OpenEMR 4.1.1 by uploading a malicious PHP script with multiple extensions via the 'name' parameter in '/library/openflashchart/php-ofc-library/ofc_upload_image.php'. It establishes a reverse shell connection to the attacker's machine.
This Metasploit module exploits an unauthenticated file upload vulnerability in OpenEMR 4.1.1 via the `ofc_upload_image.php` script, allowing arbitrary PHP code execution. It uploads a malicious PHP payload to the `tmp-upload-images` directory and executes it.
This Metasploit module exploits an arbitrary file upload vulnerability in Open Flash Chart v2 via the 'ofc_upload_image.php' script, allowing attackers to upload and execute malicious PHP files. The exploit leverages a lack of file extension validation and improper path handling to achieve remote code execution.
This Metasploit module exploits an unauthenticated file upload vulnerability in OpenEMR 4.1.1 via the `ofc_upload_image.php` script, allowing arbitrary PHP code execution. It uploads a malicious PHP payload to the `tmp-upload-images` directory and triggers execution via HTTP request.
This Metasploit module exploits a file upload vulnerability in Open Flash Chart v2 via the 'ofc_upload_image.php' script, allowing arbitrary PHP file upload and execution. The exploit uploads a malicious PHP payload and triggers its execution by accessing the uploaded file.