CVE-2005-4423
PHPFM < 0.2.3 - Authenticated Arbitrary File Upload and Remote Code Execution
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-4423. PoCs published by rUnViRuS.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in PHPFM, allowing an attacker to upload a malicious PHP file (cmd.php) containing a command execution payload via passthru($_GET['cmd']). The attacker can then execute arbitrary commands on the server by accessing the uploaded file with the cmd parameter.
Description
Unrestricted file upload vulnerability in PHPFM before 0.2.3 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to an accessible directory, as demonstrated using a file with a .php extension, aka "upload phpshell."
Exploits (1)
This exploit demonstrates an arbitrary file upload vulnerability in PHPFM, allowing an attacker to upload a malicious PHP file (cmd.php) containing a command execution payload via passthru($_GET['cmd']). The attacker can then execute arbitrary commands on the server by accessing the uploaded file with the cmd parameter.