Exploitation Summary
EIP tracks 1 public exploit for CVE-2003-1252. PoCs published by nmsh_sa.
AI-analyzed exploit summary This exploit leverages a file upload vulnerability in S8Forum's registration process to create a malicious PHP file. By injecting PHP code into the E-Mail field, an attacker can achieve remote command execution when the file is accessed via HTTP.
Description
register.php in S8Forum 3.0 allows remote attackers to execute arbitrary PHP commands by creating a user whose name ends in a .php extension and entering the desired commands into the E-mail field, which creates a web-accessible .php file that can be called by the attacker, as demonstrated using a "system($cmd)" E-mail address with a "any_name.php" username.
Exploits (1)
This exploit leverages a file upload vulnerability in S8Forum's registration process to create a malicious PHP file. By injecting PHP code into the E-Mail field, an attacker can achieve remote command execution when the file is accessed via HTTP.