CVE-2005-2616
ezUpload 2.2 - Remote Code Execution via Path Parameter File Include
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2005-2616. PoCs published by Johnnie Walker.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in ezUpload by manipulating the 'path' parameter in 'initialize.php' to include arbitrary remote PHP code. The vulnerability arises from insufficient input sanitization, allowing an attacker to execute server-side script code with the privileges of the web server.
Description
Multiple PHP file include vulnerabilities in ezUpload 2.2 allow remote attackers to execute arbitrary code via the path parameter to (1) initialize.php, (2) customize.php, (3) form.php, or (4) index.php.
Exploits (4)
This exploit demonstrates a remote file inclusion vulnerability in ezUpload by manipulating the 'path' parameter in 'initialize.php' to include arbitrary remote PHP code. The vulnerability arises from insufficient input sanitization, allowing an attacker to execute server-side script code with the privileges of the web server.
This exploit demonstrates a remote file inclusion vulnerability in ezUpload due to improper input sanitization. An attacker can execute arbitrary server-side script code by manipulating the 'path' parameter in the URL.
This exploit demonstrates a remote file inclusion vulnerability in ezUpload by manipulating the 'path' parameter in form.php to include arbitrary remote PHP code. The vulnerability arises due to insufficient input sanitization, allowing an attacker to execute server-side script code with the privileges of the web server process.
This exploit demonstrates a remote file inclusion vulnerability in ezUpload's customize.php script. By manipulating the 'path' parameter, an attacker can include and execute arbitrary remote PHP code, leading to remote code execution (RCE) with the privileges of the web server.