CVE-2009-4209

moziloCMS 1.11.1 - Cross-Site Scripting via cat and file Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-4209. PoCs published by SirGod.

AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in moziloCMS 1.11, including Local File Inclusion (LFI), Cross-Site Scripting (XSS), and Path Disclosure. The PoCs provide direct URLs to exploit these vulnerabilities without requiring authentication.

Description

Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in moziloCMS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) file parameters in an editsite action, different vectors than CVE-2008-6127 and CVE-2009-1367.

Exploits (1)

exploitdb WORKING POC VERIFIED
by SirGod · textwebappsphp
https://www.exploit-db.com/exploits/8394

The exploit demonstrates multiple vulnerabilities in moziloCMS 1.11, including Local File Inclusion (LFI), Cross-Site Scripting (XSS), and Path Disclosure. The PoCs provide direct URLs to exploit these vulnerabilities without requiring authentication.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: moziloCMS 1.11
No auth needed
Prerequisites: Access to the target web application
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/504091/100/0/threaded
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/35212

Scores

EPSS 0.0119
EPSS Percentile 63.9%

Details

CWE
CWE-79
Status published
Products (1)
mozilo/mozilocms 1.11.1
Published Dec 04, 2009
Tracked Since Feb 18, 2026