CVE-2009-3760: Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource...

Security readout for executives and security teams

This CVE describes a flaw in sample Citrix XenCenterWeb code where a remote attacker could inject PHP code into a configuration file. If that sample application was deployed on a web server, compromise could affect the host running it. The source bundle does not identify a vendor patch or confirmed active exploitation. Exposure is likely limited to environments that deployed the XenCenterWeb sample code from the XenServer Resource Kit and made config/writeconfig.php reachable. The bundle lists affected vendor and product as n/a, so broad product exposure cannot be confirmed from these sources. Prioritize verification on internet-facing management or lab systems because successful exploitation could become server-side code execution. If no deployed sample code exists, business risk is likely low. Evidence is incomplete, so the first action is targeted inventory, not broad emergency patching. Mitigation focus: Inventory systems for XenCenterWeb Resource Kit sample code deployments.; Remove or disable exposed sample code if it is not required.; Restrict public access to config/writeconfig.php and related configuration paths..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.