CVE-2009-4137

🗓️ 24 Dec 2009 16:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 67 Views🌐 WEB

The loadContentFromCookie function in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, allowing remote attackers to execute arbitrary code or upload arbitrary files

Reporter	Title	Published	Views	Family All 12
Cvelist	CVE-2009-4137	24 Dec 200916:00	–	cvelist
Debian CVE	CVE-2009-4137	24 Dec 200916:00	–	debiancve
EUVD	EUVD-2009-4107	7 Oct 202500:30	–	euvd
FreeBSD	piwik -- php code execution	10 Dec 200900:00	–	freebsd
Tenable Nessus	FreeBSD : piwik -- php code execution (fcbf56dd-e667-11de-920a-00248c9b4be7)	14 Dec 200900:00	–	nessus
NVD	CVE-2009-4137	24 Dec 200916:30	–	nvd
OpenVAS	FreeBSD Ports: piwik	14 Dec 200900:00	–	openvas
OpenVAS	FreeBSD Ports: piwik	14 Dec 200900:00	–	openvas
canvas	Immunity Canvas: PIWIK	24 Dec 200916:30	–	canvas
Prion	Code injection	24 Dec 200916:30	–	prion

NVD

Node

matomo matomoMatch0.2.25

matomo matomoMatch0.2.26

matomo matomoMatch0.2.27

matomo matomoMatch0.2.28

matomo matomoMatch0.2.29

matomo matomoMatch0.2.30

matomo matomoMatch0.2.31

matomo matomoMatch0.2.32

Source	Link
suspekt	www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/
openwall	www.openwall.com/lists/oss-security/2009/12/10/1
openwall	www.openwall.com/lists/oss-security/2009/12/09/2
suspekt	www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf
openwall	www.openwall.com/lists/oss-security/2009/12/14/2
piwik	www.piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/
sektioneins	www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/
dev	www.dev.piwik.org/trac/changeset/1637

Parameter	Position	Path	Description	CWE
cookie	header	/core/Cookie.php	Piwik unserialize() from cookie data leading to remote code execution or file upload via deserialization vectors.	CWE-20

23 Apr 2026 00:35Current

7.5High risk

Vulners AI Score7.5

CVSS 27.5

EPSS0.04884

CWE-20