Is CVE-2013-0209 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2013-0209, but active exploitation has not been confirmed.

Can CVE-2013-0209 be exploited remotely?

Yes. CVE-2013-0209 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2013-0209?

CVE-2013-0209 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2013-0209

HIGHPOC

CVE-2013-0209

CWE-287Published: January 23, 2013· Updated: Jun 16, 2026

7.5

CVSS v3.1

Official Description

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.

NVD Source

Technical Analysis

CVE-2013-0209 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A proof-of-concept (PoC) exploit exists for CVE-2013-0209. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.