Vulnerability Details : CVE-2009-4140

Public exploit exists!
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
Published 2009-12-22 22:30:01
Updated 2025-04-09 00:30:58
Source Red Hat, Inc.
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2009-4140

Exploit prediction scoring system (EPSS) score for CVE-2009-4140

EPSS FAQ
91.75%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2009-4140

  • Open Flash Chart v2 Arbitrary File Upload
    Disclosure Date: 2009-12-14
    First seen: 2020-04-26
    exploit/unix/webapp/open_flash_chart_upload_exec
    This module exploits a file upload vulnerability found in Open Flash Chart version 2. Attackers can abuse the 'ofc_upload_image.php' file in order to upload and execute malicious PHP files. Authors: - Braeden Thomas - Gjoko Krstic <gjoko@zeroscience.mk> - Hali
  • OpenEMR PHP File Upload Vulnerability
    Disclosure Date: 2013-02-13
    First seen: 2020-04-26
    exploit/unix/webapp/openemr_upload_exec
    This module exploits a vulnerability found in OpenEMR 4.1.1 By abusing the ofc_upload_image.php file from the openflashchart library, a malicious user can upload a file to the tmp-upload-images directory without any authentication, which results in arbitrary code e

CVSS scores for CVE-2009-4140

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST

References for CVE-2009-4140

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close