CVE-2002-1481
phpgb <= 1.20 - Unauthenticated Arbitrary PHP Code Execution via savesettings.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2002-1481. PoCs published by ppp-design.
AI-analyzed exploit summary This exploit demonstrates a PHP code injection vulnerability in phpGB by bypassing authentication and injecting malicious code into the guestbook configuration file (config.php) via the savesettings.php script. The injected code (e.g., phpinfo()) is executed when other scripts reference the configuration file.
Description
savesettings.php in phpGB 1.20 and earlier does not require authentication, which allows remote attackers to cause a denial of service or execute arbitrary PHP code by using savesettings.php to modify config.php.
Exploits (1)
This exploit demonstrates a PHP code injection vulnerability in phpGB by bypassing authentication and injecting malicious code into the guestbook configuration file (config.php) via the savesettings.php script. The injected code (e.g., phpinfo()) is executed when other scripts reference the configuration file.