CVE-2009-4140: High severity open flash chart vulnerability
Unrestricted file upload vulnerability in ofcuploadimage.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when registerglobals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTPRAWPOSTDATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4140?
CVE-2009-4140 is considered a high severity vulnerability due to its potential for remote file upload leading to arbitrary code execution.
How do I fix CVE-2009-4140?
To fix CVE-2009-4140, disable register_globals in your PHP configuration and ensure proper validation of uploaded files.
What systems are affected by CVE-2009-4140?
CVE-2009-4140 affects Open Flash Chart versions 2.0-beta_1 through 2.0-lug_wyrm_charmer and specific versions of Piwik and Woopra Analytics Plugin.
What type of vulnerability is CVE-2009-4140?
CVE-2009-4140 is an unrestricted file upload vulnerability that allows authenticated remote users to upload malicious files.
Who is responsible for the CVE-2009-4140 vulnerability?
The CVE-2009-4140 vulnerability was identified in the Open Flash Chart software created by Teethgrinder.co.uk.