CVE-2006-6338

deV!L`z Clanportal < 1.3.6.1 - Unauthenticated Arbitrary File Upload via Image File Embedding

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-6338. PoCs published by Tim Weber.

AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in deV!L`z Clanportal, allowing remote attackers to upload and execute PHP code by disguising it as a valid JPEG/GIF file. The PoC uses curl to upload a malicious file, bypassing image validation checks.

Description

Unrestricted file upload vulnerability in upload/index.php in deV!L`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to upload and execute arbitrary .php files by embedding PHP code in a JPEG or GIF file that is uploaded to inc/images/uploads/userpics/.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Tim Weber · textwebappsphp

https://www.exploit-db.com/exploits/2876

View Code ZIP pw:eip

This exploit demonstrates an arbitrary file upload vulnerability in deV!L`z Clanportal, allowing remote attackers to upload and execute PHP code by disguising it as a valid JPEG/GIF file. The PoC uses curl to upload a malicious file, bypassing image validation checks.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: deV!L`z Clanportal <= 1.3.6

No auth needed

Prerequisites: A file that is both a valid JPEG/GIF and valid PHP code · Access to the target's upload endpoint

MITRE ATT&CK