CVE-2009-3716

CVE-2009-3716 describes an unrestricted file upload vulnerability in MCshoutbox 1.1, specifically within the admin.php component. An authenticated attacker can exploit this by uploading a file with an executable extension, then directly accessing it in the smilies/ directory to execute arbitrary code. This vulnerability carries a CVSS score of 6.5, indicating a medium severity due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an ExploitDB entry (EDB-9205) exists, demonstrating proof-of-concept for SQL Injection, Cross-Site Scripting, and shell access, though there is no evidence of widespread active exploitation or significant community discussion.