vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2009-4140

N/A
Published: December 22, 2009 at 10:00 PM UTC
Updated: June 16, 2026 at 11:13 PM UTC
2 products affected across 2 vendorsMatomoOpen Flash Chart

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 76%

Description

Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (16)

x_refsource_MISC
Source: [email protected]
http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt
x_refsource_MISC
Source: [email protected]
http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt
x_refsource_MISCExploit
Source: [email protected]
http://packetstormsecurity.org/0910-exploits/piwik-upload.txt
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/37078
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/37911
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/55160
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/55162

CVSS

7.5HIGH[email protected]
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-Other

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card