Vulnerability record · CVE-2013-0209 · published 23 January 2013
CVE-2013-0209: Movable Type mt-upgrade.cgi unauthenticated eval and SQL injection
SSixapart · Movable Type
Movable Type 4.2x and 4.3x through 4.38 fails to require authentication for database-migration functions in lib/MT/Upgrade.pm reached through mt-upgrade.cgi. Crafted parameters allow eval injection and SQL injection, with the demonstrated case hitting core_drop_meta_for_table to run arbitrary Perl code. The flaw matters because it is remotely reachable without credentials and yields code execution on the server.
Description
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated remote code execution with public exploit code and very high EPSS probability makes this an urgent patch target.
What it is
Movable Type 4.2x and 4.3x through 4.38 fails to require authentication for database-migration functions in lib/MT/Upgrade.pm reached through mt-upgrade.cgi. Crafted parameters allow eval injection and SQL injection, with the demonstrated case hitting core_drop_meta_for_table to run arbitrary Perl code. The flaw matters because it is remotely reachable without credentials and yields code execution on the server.
Impact
An unauthenticated remote attacker can execute arbitrary Perl code and inject SQL, giving full control of the application and likely the underlying database and host.
Attack surface
Reached over the network via HTTP requests to mt-upgrade.cgi; the CVSS vector AV:N/AC:L/Au:N confirms no authentication and no user interaction are required.
Exploitation
Public exploit code is referenced (sec-1.com tags include Exploit), but the CVE is not in CISA KEV and no ransomware use is documented; EPSS 30-day probability is 0.45201 (98.7th percentile), indicating high predicted exploitation activity.
What to do
- Apply the vendor patch referenced in the Movable Type 4.38 patch advisory, or upgrade to a fixed release.
- If patching is not immediately possible, block or restrict access to mt-upgrade.cgi at the web server or WAF.
- Remove or disable unused database-migration scripts from the web root.
- Run the Movable Type application with least-privilege database and OS accounts to limit post-exploitation impact.
- Review web server logs for unexpected requests to mt-upgrade.cgi.
Detection
- Search HTTP access logs for requests to mt-upgrade.cgi, especially with unusual or crafted parameters.
- Monitor for unexpected Perl process execution or child processes spawned by the web server.
- Alert on anomalous SQL statements or schema changes originating from the web application.
- Use file integrity monitoring on Movable Type application files to catch dropped payloads.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-0209 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-0209), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
