RCE in Eaccelerator

CVE-2009-2353

encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web root via the -o option, and then making a direct request to this file, related to upload of image files.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.020 (78.2th percentile) — read the EPSS interpretation.

Affected products

  • Eaccelerator — versions 0.9.4, 0.9.5, 0.9.5.1
  • N/a — versions n/a

Weakness classification (CWE)

References