CVE-2009-2331: Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inj...

Security readout for executives and security teams

CMS Chainuk 1.2 and earlier can let a remote attacker inject PHP code into application files. If exploited on a live site, this could become server-side code execution through the CMS. The source bundle does not provide CVSS, vendor patch details, or evidence of active exploitation. Exposure is most likely limited to legacy CMS Chainuk deployments. Any internet-reachable CMS Chainuk 1.2 or earlier instance should be treated as potentially exposed, especially if the named PHP endpoints are reachable. The bundle does not identify hosted services, downstream products, or package CPEs. Prioritize remediation if CMS Chainuk is present on any public site. The product appears old and source evidence is incomplete, so first confirm whether it exists in the environment. If found, replace or isolate it quickly rather than relying on compensating controls. Mitigation focus: Identify and retire any CMS Chainuk 1.2 or earlier deployments.; Check vendor or maintainer guidance for any official fixed release.; Restrict public access to the affected administrative PHP endpoints..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.