CVE-2009-0372 File upload in n/a

Medium 6.5 Published 30 Jan 2009 Updated 7 Aug 2024

Authenticated users can upload malicious files to execute arbitrary code on the server via the profile editing feature.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2009-0372?

CVE-2009-0372 is a medium-severity vulnerability in n/a, published on 30 Jan 2009. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and an image content type via a users editProfile action, then accessing this file via a direct request to the file in images/avatar/uploaded/.

Weakness: CWE-20

Which versions are affected by CVE-2009-0372?

It affects 1 product.

Products include Memht Memht Portal.

How do I fix CVE-2009-0372?

No fix has been published for CVE-2009-0372 yet. Limit exposure of the affected software until one is available.

Is CVE-2009-0372 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-0372 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-xhf5-wgpx-m22c.