Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-4878. PoCs published by Kacper.
AI-analyzed exploit summary This exploit targets a file upload vulnerability in PHP-Post <= 1.01, allowing remote code execution by uploading a malicious GIF file containing PHP code and then triggering its execution via a path traversal in the template parameter.
Description
Directory traversal vulnerability in footer.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to read and include arbitrary local files via a .. (dot dot) sequence in the template parameter. NOTE: this was later reported to affect 1.0.1, and demonstrated for code execution by uploading and accessing an avatar file.
Exploits (1)
This exploit targets a file upload vulnerability in PHP-Post <= 1.01, allowing remote code execution by uploading a malicious GIF file containing PHP code and then triggering its execution via a path traversal in the template parameter.