PT-2025-35367 · Benetool+3 · Benetool+3

Published 2025-08-30 · Updated 2025-08-30 · CVE-2009-20011

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10

Description ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, potentially resulting in root-level access.

Recommendations Update to version 125.10 or later.

Fix

Unrestricted File Upload

OS Command Injection

Weakness Enumeration

CWE-434

CWE-78

Related Identifiers

CVE-2009-20011

Affected Products

Apache

Contentkeeper Web Appliance

Benetool

Mimencode

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2009-20011 · Security Note
• https://vulncheck.com/advisories/contentkeeper-web-appliance-rce-via-mimencode · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/contentkeeperweb_mimencode.rb · Note
• https://t.me/CVEtracker/31329 · Telegram Post
• https://ativion.com/contentkeeper · Note
• https://web.archive.org/web/20081220084819/http://contentkeeper.com · Note
• http://aushack.com/200904-contentkeeper.txt · Note