« Volver al listado

CVE-2009-2353

Estado: ModificadaMedia (6.8)—

encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web root via the -o option, and then making a direct request to this file, related to upload of image files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Eaccelerator — Eaccelerator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-2353",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-07-07T23:30:00.297",
  "references": [
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:188",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/504695/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:188",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/504695/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web root via the -o option, and then making a direct request to this file, related to upload of image files."
    },
    {
      "lang": "es",
      "value": "Encoder.php en eAccelerator permite a atacantes remotos ejecutar código a su elección copiando archivos ejecutables locales bajo la cuenta de administrador web a través de la opción -o y luego realizar una solicitud de dicho archivo, relacionado con la subida de ficheros de tipo imágen."
    }
  ],
  "lastModified": "2026-06-16T23:09:16.367",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eaccelerator:eaccelerator:0.9.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FCFAAEC-5080-4725-92FA-B52D995EEA52"
            },
            {
              "criteria": "cpe:2.3:a:eaccelerator:eaccelerator:0.9.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D324A10D-C39E-4B15-9934-36DDB1A264C3"
            },
            {
              "criteria": "cpe:2.3:a:eaccelerator:eaccelerator:0.9.5:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF7309B6-80BF-4BFF-9362-D8F425D338FC"
            },
            {
              "criteria": "cpe:2.3:a:eaccelerator:eaccelerator:0.9.5:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EABE705C-14E3-4638-990F-E45AB15F99E7"
            },
            {
              "criteria": "cpe:2.3:a:eaccelerator:eaccelerator:0.9.5:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5291F26A-0875-4A36-ABA3-1B6BBF196711"
            },
            {
              "criteria": "cpe:2.3:a:eaccelerator:eaccelerator:0.9.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C93F82A7-A2E5-456A-B1B3-D1D97A330EB5"
            },
            {
              "criteria": "cpe:2.3:a:eaccelerator:eaccelerator:0.9.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7837E3C-E0F5-4518-B98C-5EBE8F4E48FA"
            },
            {
              "criteria": "cpe:2.3:a:eaccelerator:eaccelerator:0.9.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0B435D1-315B-4C39-BDC0-40E930A750D0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}