Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Open Flash Chart file upload lets attackers run code

CVE-2009-4140 · published 16 years ago
Summary

The Open Flash Chart component used in Matomo can let a logged‑in user upload a file with a dangerous extension when a legacy PHP setting (register_globals) is turned on. That file can then be accessed and executed, giving the attacker control of the server. Fix the issue by applying the latest component updates, disabling the register_globals setting, or removing the vulnerable upload feature.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
teethgrinder.co.uk open_flash_chart 2.0
cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:beta_1:*:*:*:*:*:*
matomo matomo 0.2.37
0.4.2
0.4.3
cpe:2.3:a:matomo:matomo:0.2.37:*:*:*:*:*:*:*
Original advisory text
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3...
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
76% chance of attack within 30 days
Timeline
Published22 Dec 2009
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2009-4140 · NVD
Track software like this
Free during beta