CVE-2009-4623

Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACS_path parameter to (1) index.php and (2) admin.php in advanced_comment_system/. NOTE: this might only be a vulnerability when the administrator has not followed installation instructions in install.php. NOTE: this might be the same as CVE-2020-35598.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

9.85% chance of exploitation in the next 30 days, 95th percentile

Published

2010-01-18

Updated

2024-08-07

Proof-of-concept exploits (5)

• http://www.exploit-db.com/exploits/9623
• MonsempesSamuel/CVE-2009-46230★ · 2022-10-12
• hupe1980/CVE-2009-46230★ · 2022-08-19
• kernel-cyber/CVE-2009-46231★ · 2022-09-15
• sammonsempes/CVE-2009-4623

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/9623

References

• CVE Record
• NVD entry

Related

• CVE-2021-3129
• CVE-2021-43798
• CVE-2022-24637
• CVE-2022-29464
• CVE-2006-3392
• CVE-2021-42913