CVE-2005-4449
FlatNuke 2.5.6 - Authenticated Arbitrary PHP File Modification via verify.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-4449. PoCs published by rgod.
AI-analyzed exploit summary This exploit targets Flatnuke 2.5.6, leveraging a privilege escalation vulnerability due to improper handling of user input when magic_quotes_gpc is off. It allows remote command execution by manipulating admin credentials and injecting malicious PHP code into user files.
Description
verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting the code into the body parameter. NOTE: if a FlatNuke administrator is normally assumed to be able to modify arbitrary content, then this issue does not cross privilege boundaries and would not be a vulnerability.
Exploits (1)
This exploit targets Flatnuke 2.5.6, leveraging a privilege escalation vulnerability due to improper handling of user input when magic_quotes_gpc is off. It allows remote command execution by manipulating admin credentials and injecting malicious PHP code into user files.