CVE-2005-1894
FlatNuke 2.5.3 - Remote Code Execution via Referer Header Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-1894. PoCs published by SecWatch.
AI-analyzed exploit summary This PHP script is a proof-of-concept for CVE-2005-1894, exploiting an arbitrary command injection vulnerability in FlatNuke 2.5.3. It leverages improper input sanitization in the referer.php script to execute system commands via a crafted HTTP Referer header.
Description
Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker.
Exploits (1)
This PHP script is a proof-of-concept for CVE-2005-1894, exploiting an arbitrary command injection vulnerability in FlatNuke 2.5.3. It leverages improper input sanitization in the referer.php script to execute system commands via a crafted HTTP Referer header.