CVE-2009-2331

Published: Jul 5, 2009Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary PHP code (1) into settings.php via the menu parameter to admin_settings.php or (2) into a content/=NUMBER.php file via the title parameter to admin_new.php.

Affected (1)

Products: Cms.tut.su: Cms Chainuk

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cms.tut.su Cms Chainuk	Up to 1.2

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (6)

http://osvdb.org/55672

Source: cve@mitre.org

http://osvdb.org/55673

Source: cve@mitre.org

http://www.exploit-db.com/exploits/9069

Source: cve@mitre.org

http://osvdb.org/55672

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/55673

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.exploit-db.com/exploits/9069

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.