CVE-2009-4224

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-12-07 · updated 2026-06-16
Weakness: CWE-20

Description

Multiple PHP remote file inclusion vulnerabilities in SweetRice 0.5.4, 0.5.3, and earlier allow remote attackers to execute arbitrary PHP code via a URL in the root_dir parameter to (1) _plugin/subscriber/inc/post.php and (2) as/lib/news_modify.php.

Affected products

Basic-Cms Sweetrice: through 0.5.4; 0.2.0, 0.2.1, 0.3.0, 0.3.1, 0.4.0, 0.4.1 (+6)

References

http://packetstormsecurity.org/0911-exploits/sweetrice-rfilfi.txt
http://secunia.com/advisories/37522
http://www.exploit-db.com/exploits/10246
http://www.osvdb.org/60581
http://www.osvdb.org/60582
https://exchange.xforce.ibmcloud.com/vulnerabilities/54446
http://packetstormsecurity.org/0911-exploits/sweetrice-rfilfi.txt
http://secunia.com/advisories/37522
http://www.exploit-db.com/exploits/10246
http://www.osvdb.org/60581
http://www.osvdb.org/60582
https://exchange.xforce.ibmcloud.com/vulnerabilities/54446

Get alerted when CVE-2009-4224 or the next vulnerability affects your stack