CVE-2009-1792

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-05-29 · updated 2026-06-16
Weakness: CWE-78

Description

The system.openURL function in StoneTrip Ston3D StandalonePlayer (aka S3DPlayer StandAlone) 1.6.2.4 and 1.7.0.1 and WebPlayer (aka S3DPlayer Web) 1.6.0.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the first argument (the sURL argument).

Affected products

Stonetrip S3Dplayer Standalone: 1.6.2.4, 1.7.0.1
Stonetrip S3Dplayer Web: 1.6.0.0

References

http://secunia.com/advisories/35256
http://www.coresecurity.com/content/StoneTrip-S3DPlayers
http://www.securityfocus.com/archive/1/503887/100/0/threaded
http://www.securityfocus.com/bid/35105
http://secunia.com/advisories/35256
http://www.coresecurity.com/content/StoneTrip-S3DPlayers
http://www.securityfocus.com/archive/1/503887/100/0/threaded
http://www.securityfocus.com/bid/35105

Get alerted when CVE-2009-1792 or the next vulnerability affects your stack