CVE-2009-20010 Dogfood CRM spell.php RCE
Unauthenticated attackers can execute arbitrary shell commands on the server via unsanitized input in the spell.php script of Dogfood CRM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2009-20010?
CVE-2009-20010 is a critical command injection vulnerability in Dogfood CRM, published on 30 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from unsanitized user input passed via a POST request to the data parameter, which is processed by the underlying shell without adequate escaping. This allows attackers to inject arbitrary shell commands and execute them on the server. The flaw is exploitable without authentication and was discovered by researcher LSO.
Weakness: CWE-78
Which versions are affected by CVE-2009-20010?
How do I fix CVE-2009-20010?
No fix has been published for CVE-2009-20010 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2009-20010 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-20010 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-c5g4-6hj2-c647.