CVE-2009-3041

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://fil.rezo.net/secu-14346-14350+14354.patchPatch
http://secunia.com/advisories/36365Vendor Advisory
http://www.securityfocus.com/bid/36008Exploit
http://www.spip-contrib.net/SPIP-Security-Alert-new-versionPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52381
http://fil.rezo.net/secu-14346-14350+14354.patchPatch
http://secunia.com/advisories/36365Vendor Advisory
http://www.securityfocus.com/bid/36008Exploit
http://www.spip-contrib.net/SPIP-Security-Alert-new-versionPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52381

Timeline

Published: Sep 1, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-30427.5SQL injection vulnerability in machine.php in Open Computer and Software (OCS) Inventory NG 1.02.1 allows remote attackers to execute arbitr CVE-2009-30434.9The tty_ldisc_hangup function in drivers/char/tty_ldisc.c in the Linux kernel 2.6.31-rc before 2.6.31-rc8 allows local users to cause a deni CVE-2009-30445.0Opera before 10.00 does not properly handle a (1) '\0' character or (2) invalid wildcard character in a domain name in the subject's Common CVE-2009-30455.0Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to sp CVE-2009-30467.5Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass CVE-2009-30474.3Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the c CVE-2009-30484.3Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attac CVE-2009-30495.0Opera before 10.00 does not properly display all characters in Internationalized Domain Names (IDN) in the address bar, which allows remote CVE-2009-305010.0Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitr CVE-2009-30517.5Multiple format string vulnerabilities in lib/silcclient/client_entry.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, a CVE-2009-30526.5SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote aut CVE-2009-30536.8Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbit