CVE-2009-1551

published 2009-05-06

CVE-2009-1551: Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) qte_web_path…

Priority P3 55 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) qte_web_path parameter to qte_web.php and the (2) qte_root parameter to bin/qte_init.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
qt-cute	quickteam	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /qte_web.php?qte_web_path=↗

path /bin/qte_init.php?qte_root=↗

• → Monitor HTTP requests to /qte_web.php containing a URL-like value in the 'qte_web_path' parameter, indicating remote file inclusion attempt. ↗
• → Monitor HTTP requests to /bin/qte_init.php containing a URL-like value in the 'qte_root' parameter, indicating remote file inclusion attempt. ↗
• → RFI payloads for this CVE use a trailing '?' to nullify the appended path suffix (e.g., shell.txt?), look for query parameters ending with '?' in web logs targeting these scripts. ↗
• → The vulnerable parameters are 'qte_web_path' in qte_web.php and 'qte_root' in bin/qte_init.php; alert on any external (http/https/ftp) URL supplied to either parameter. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94