CVE-2009-1463

Published: Apr 28, 2009Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file.

Affected (3)

Products: Razorcms: Razorcms

Razorcms

1 product

Razorcms

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Razorcms Razorcms	Up to 0.3
Razorcms Razorcms	Version 0.2
Razorcms Razorcms	Version 0.3 rc2

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (10)

http://marc.info/?l=full-disclosure&m=123990481506680&w=2

Source: cve@mitre.org

Exploit

http://marc.info/?l=full-disclosure&m=123998062108561&w=2

Source: cve@mitre.org

Exploit

http://razorcms.co.uk/support/viewtopic.php?f=13&t=325

Source: cve@mitre.org

ExploitVendor Advisory

http://www.securityfocus.com/bid/34566

Source: cve@mitre.org

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/50359

Source: cve@mitre.org

http://marc.info/?l=full-disclosure&m=123990481506680&w=2