CVE-2015-10009

CVE-2015-10009 is a critical code injection vulnerability affecting nonfiction nterchange versions up to 4.1.0. Specifically, the getContent function in app/controllers/code_caller_controller.php is susceptible to manipulation of the 'q' argument, allowing for arbitrary code execution. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network without authentication or user interaction, leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation in the wild or readily available Metasploit/Nuclei modules, the exploit details have been publicly disclosed, and the vulnerability has garnered significant community discussion, indicating potential for future exploitation. Upgrading to nterchange 4.1.1 is strongly recommended to remediate this issue.