PT-2009-6311 · Piwik+2 · Piwik+2

Anthon Pang + 1 · Published 2009-12-22 · Updated 2019-11-21 · CVE-2009-4140

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Flash Chart versions 2 Beta 1 through 2 Piwik versions 0.2.35 through 0.4.3 Woopra Analytics Plugin versions prior to 1.4.3.2

Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP RAW POST DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/. This is possible when register globals is enabled.

Recommendations For Open Flash Chart versions 2 Beta 1 through 2, restrict access to the ofc upload image.php file to prevent unauthorized uploads. For Piwik versions 0.2.35 through 0.4.3, update the Woopra Analytics Plugin to version 1.4.3.2 or later to mitigate the risk. For Woopra Analytics Plugin versions prior to 1.4.3.2, update to version 1.4.3.2 or later to resolve the issue. As a temporary workaround, consider disabling the register globals setting until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2009-4140

Affected Products

Open Flash Chart

Piwik

Woopra Analytics Plugin

References · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/open_flash_chart_upload_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/openemr_upload_exec.rb · Exploit
• 🔥 http://securityfocus.com/bid/37314 · Exploit
• 🔥 https://exploit-db.com/exploits/10532 · Exploit
• 🔥 https://exploit-db.com/exploits/24969 · Exploit
• 🔥 https://exploit-db.com/exploits/29091 · Exploit
• 🔥 http://packetstormsecurity.org/0910-exploits/piwik-upload.txt · Exploit
• 🔥 https://exploit-db.com/exploits/24529 · Exploit
• 🔥 http://exploit-db.com/exploits/24969 · Exploit
• 🔥 https://exploit-db.com/exploits/24492 · Exploit
• 🔥 https://exploit-db.com/exploits/29210 · Exploit
• http://secunia.com/advisories/37911 · Vendor Advisory
• http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2966 · Vendor Advisory
• http://secunia.com/advisories/37078 · Vendor Advisory