PT-2009-6004 · Citrix · Citrix Xencenterweb

Alberto Trivero + 1 · Published 2009-10-22 · Updated 2017-09-19 · CVE-2009-3760

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Citrix XenCenterWeb (affected versions not specified)

Description A static code injection issue exists in the sample code of the XenServer Resource Kit in Citrix XenCenterWeb. This allows remote attackers to inject arbitrary PHP code into include/config.ini.php via the pool1 parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3760

Affected Products

Citrix Xencenterweb

References · 8

• 🔥 http://securenetwork.it/ricerca/advisory/download/SN-2009-01.txt · Exploit
• 🔥 https://exploit-db.com/exploits/9106 · Exploit
• 🔥 http://securityfocus.com/archive/1/504764 · Exploit
• 🔥 http://exploit-db.com/exploits/9106 · Exploit
• 🔥 http://securityfocus.com/bid/35592 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3760 · Security Note
• http://vupen.com/english/advisories/2009/1814 · Vendor Advisory
• http://securitytracker.com/id?1022520 · Note