Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2009-2770: PowerUpload 2.4 lets attackers gain admin access
CVE-2009-2770 · published 17 years ago
Summary
The PowerUpload 2.4 web application can be tricked into treating a user as an administrator by sending a specially crafted cookie. This means an attacker could log in without permission and control the system. Apply the vendor’s update or configuration fix that validates the admin cookie properly.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| powerupload | powerupload |
2.4 cpe:2.3:a:powerupload:powerupload:2.4:*:*:*:*:*:*:* |
Original advisory text
PowerUpload 2.4 allows remote attackers to bypass authentication and gain administrative access via a MIME encoded value of admin for the myadminname cookie.
PowerUpload 2.4 allows remote attackers to bypass authentication and gain administrative access via a MIME encoded value of admin for the myadminname cookie.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published14 Aug 2009
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-2770 · NVD
Track software like this
Free during beta