HOME VULNERABILITIESCVE-2009-4140

HIGHPOC

CVE-2009-4140

NVD-CWE-OtherPublished: December 22, 2009· Updated: Jun 16, 2026

7.5

CVSS v3.1

Official Description

Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.

Technical Analysis

CVE-2009-4140 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A proof-of-concept (PoC) exploit exists for CVE-2009-4140. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.

User Interaction

Scope

Impact

ConfidentialityP

IntegrityP

AvailabilityP

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected Vendors & Products

matomo1 product(s)

matomo

teethgrinder.co.uk1 product(s)

open flash chart

Source: NVD CPE · 4 total CPE entries

Exploit & PoC Resources

POC AVAILABLEProof-of-concept code exists

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttp://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/

ADVISORYhttp://secunia.com/advisories/37078

ADVISORYhttp://secunia.com/advisories/37911

ADVISORYhttp://www.vupen.com/english/advisories/2009/2966

ADVISORYhttp://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/

ADVISORYhttp://secunia.com/advisories/37078

ADVISORYhttp://secunia.com/advisories/37911

ADVISORYhttp://www.vupen.com/english/advisories/2009/2966

All References (32)

→

http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt

→

http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt

→

http://packetstormsecurity.org/0910-exploits/piwik-upload.txtExploit

→

http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/Vendor Advisory

→

http://secunia.com/advisories/37078Vendor Advisory

→

http://secunia.com/advisories/37911Vendor Advisory

→

http://secunia.com/advisories/55160

→

http://secunia.com/advisories/55162

→

http://wordpress.org/extend/plugins/woopra/changelog/

→

http://www.exploit-db.com/exploits/24969

→

http://www.openwall.com/lists/oss-security/2009/12/14/1

→

http://www.openwall.com/lists/oss-security/2009/12/14/3

→

http://www.osvdb.org/59051

→

http://www.securityfocus.com/bid/37314Exploit

→

http://www.vupen.com/english/advisories/2009/2966Vendor Advisory

Quick Facts

CVE IDCVE-2009-4140

CVSS Score7.5 / 10

SeverityHIGH

WeaknessNVD-CWE-Other

CISA KEVNo

ExploitPOC

Affected2 vendor(s)

PublishedDec 22, 2009

Related CVEs (NVD-CWE-Other)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2009-4140 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2009-4140·NVD