Vulnerability record · CVE-2009-4140 · published 22 December 2009
CVE-2009-4140: Open Flash Chart unrestricted file upload enables remote code execution
TTeethgrinder.Co.Uk · Open Flash Chart
ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as bundled in Piwik 0.2.35 through 0.4.3 and the Woopra Analytics Plugin before 1.4.3.2, accepts an uploaded file whose name and content are attacker-controlled. When register_globals is enabled, a remote authenticated user can write a file with an executable extension into tmp-upload-images/ and then request it directly, achieving code execution.
Description
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote code execution with public exploit code and very high EPSS, though it requires authentication and register_globals enabled.
What it is
ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as bundled in Piwik 0.2.35 through 0.4.3 and the Woopra Analytics Plugin before 1.4.3.2, accepts an uploaded file whose name and content are attacker-controlled. When register_globals is enabled, a remote authenticated user can write a file with an executable extension into tmp-upload-images/ and then request it directly, achieving code execution.
Impact
An attacker with a valid account gains arbitrary code execution under the web server's user, allowing full compromise of the host and any data it can reach.
Attack surface
Reached over the network through the ofc_upload_image.php endpoint; the description requires an authenticated user, and no user interaction beyond the upload request is described. Exploitation depends on the PHP register_globals setting being enabled.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.758, 99.5th percentile) and multiple references are tagged Exploit, including public exploit-db and Packet Storm entries.
What to do
- Upgrade or remove the affected Open Flash Chart component; apply the Piwik and Woopra Analytics Plugin fixes referenced in the vendor advisories.
- Disable PHP register_globals, which the description identifies as a precondition for exploitation.
- Restrict or block direct HTTP access to the tmp-upload-images/ directory and disallow script execution there.
- Enforce upload validation: whitelist extensions, verify content type, and store uploads outside the web root.
- Limit accounts that can reach the upload endpoint and review them for least privilege.
Detection
- Monitor web logs for POST requests to ofc_upload_image.php followed by GET requests to files under tmp-upload-images/.
- Alert on newly created executable files (for example .php) inside upload or tmp directories.
- Check PHP configuration for register_globals being enabled on hosts running the affected products.
- Hunt for unexpected outbound connections or child processes spawned by the web server user.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2009-4140 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2009-4140), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
