CVE-2009-3478

CVE-2009-3478 describes an argument injection vulnerability in FireFTP Extension 1.0.5 for Firefox, affecting both Mozilla Firefox and Nightlight Firefox with the FireFTP extension. This flaw allows remote authenticated SFTP users to manipulate file operations (alter permissions, delete, download, or move) by injecting double quotes into filenames, which are not properly sanitized when constructing commands for psftp.exe. The vulnerability has a CVSS score of 6.0, indicating a medium severity with a network attack vector, medium attack complexity, and requiring user authentication, potentially leading to partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, no known public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage, suggesting low current attention.