PT-2009-4045 · Qt Company · Qt

Ahmadbady · Published 2009-05-06 · Updated 2017-09-29 · CVE-2009-1551

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Qt quickteam 2

Description: The issue allows remote attackers to execute arbitrary PHP code. This is achieved via a URL in the qte web path parameter to "qte web.php" and the qte root parameter to "bin/qte init.php".

Recommendations: For Qt quickteam 2, consider disabling the qte web.php and bin/qte init.php scripts until a patch is available. Restrict access to the qte web path and qte root parameters to minimize the risk of exploitation. Avoid using the qte web path and qte root parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-1551

Affected Products

Qt

References · 6

• 🔥 https://exploit-db.com/exploits/8602 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1551 · Security Note
• http://secunia.com/advisories/34997 · Note
• http://vupen.com/english/advisories/2009/1247 · Note
• http://osvdb.org/54218 · Note
• http://osvdb.org/54217 · Note