RCE in Cutephp Cutenews

CVE-2009-4115

Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the (1…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.020 (78.5th percentile) — read the EPSS interpretation.

Affected products

Cutephp Cutenews — versions 1.4.6
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)