CVE-2005-2564

Gravity Board X <1.1 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-2564. PoCs published by RusH.

AI-analyzed exploit summary This exploit targets Gravity Board X v1.1 by injecting PHP code into the 'editcss.php' file via the 'csscontent' parameter, enabling remote command execution. It leverages LWP::UserAgent to send HTTP requests and execute arbitrary commands on the vulnerable system.

Description

Direct static code injection vulnerability in editcss.php in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary PHP code, HTML, and script via the csscontent parameter, which is directly inserted into the gbxfinal.css file.

Exploits (1)

exploitdb WORKING POC VERIFIED
by RusH · perlwebappsphp
https://www.exploit-db.com/exploits/1510

This exploit targets Gravity Board X v1.1 by injecting PHP code into the 'editcss.php' file via the 'csscontent' parameter, enabling remote command execution. It leverages LWP::UserAgent to send HTTP requests and execute arbitrary commands on the vulnerable system.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Gravity Board X v1.1
No auth needed
Prerequisites: Network access to the target web application · The 'editcss.php' file must be accessible and writable
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=112351740803443&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/21742

Scores

EPSS 0.0509
EPSS Percentile 91.3%

Details

Status published
Products (1)
gravity_board_x_development_team/gravity_board_x 1.1
Published Aug 16, 2005
Tracked Since Feb 18, 2026