Unscored severity · published Dec 22, 2009
CVE-2009-4140
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics…
–
CVSS
75.8%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
Exploitation
Is it being used?
Exploit prediction (EPSS)75.8% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Matomo · Matomo
0.2.37; 0.4.2; 0.4.3 · source: NVD
OF
Open Flash Chart · Teethgrinder.co.uk
2.0; 2.0; 2.0; 2.0; 2.0; 2.0; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4140
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4140
packetstormsecurity.com
http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt
packetstormsecurity.com
http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt
Exploit
http://packetstormsecurity.org/0910-exploits/piwik-upload.txt
Vendor Advisory
http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/
Vendor Advisory
http://secunia.com/advisories/37078
Vendor Advisory
http://secunia.com/advisories/37911
More from Matomo
6.1
CVE-2023-6923
Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite
6.1
CVE-2013-0195
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
6.1
CVE-2013-0194
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
6.1
CVE-2013-0193
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
4.3
CVE-2019-12215
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because…