CVE-2009-2736 Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the "Overall Width" field in a s...
MediumCVSS 6.5
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the "Overall Width" field in a setconfig action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun-jester opennews | = 1.0 | No fix listed |
References
- 56813 vdb-entry
- 36154 third-party-advisory vendor-advisory
- 9371 exploit
- ADV-2009-2168 vdb-entry vendor-advisory
- opennews-admin-sql-injection(52289) vdb-entry