CVE-2009-4223

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

PHP remote file inclusion vulnerability in adm/krgourl.php in KR-Web 1.1b2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.

7.5

CVSS

54.6%

EPSS (exploit prob.)

99th

EPSS percentile

2009-12-07

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
gianni_tommasi	kr-php_web_content_server	<= 1.1
gianni_tommasi	kr-php_web_content_server	1.1
gianni_tommasi	kr-php_web_content_server	1.1

Check a specific version with /api/v1/cve/match.

References

http://www.exploit-db.com/exploits/10216
https://exchange.xforce.ibmcloud.com/vulnerabilities/54395
http://www.exploit-db.com/exploits/10216
https://exchange.xforce.ibmcloud.com/vulnerabilities/54395

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-4223