CVE-2009-20010 is a critical remote command execution vulnerability in Dogfood CRM version 2.0.10, specifically within the spell.php script of its mail subsystem. This flaw allows unauthenticated attackers to inject and execute arbitrary shell commands on the server by sending unsanitized input via a POST request to the 'data' parameter. With a CVSS score of 9.3 (CRITICAL) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk due to its network-based attack vector, low complexity, and potential for complete compromise of confidentiality, integrity, and availability. Exploit intelligence confirms the availability of a Metasploit module, and the vulnerability has garnered substantial community discussion, suggesting active awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Dogfood CRM | Dogfood CRM | >= 0, <= 2.0.10CNA affecteddefault unaffected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.