CVE-2009-2736

EPSS 4.8%

Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the "Overall Width" field in a setconfig action.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/9371unverified exploitdbwww.exploit-db.com/exploits/9371unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/56813 http://secunia.com/advisories/36154 https://exchange.xforce.ibmcloud.com/vulnerabilities/52289 http://www.exploit-db.com/exploits/9371 http://www.vupen.com/english/advisories/2009/2168