CVE-2006-7134
Upload Tool for PHP 1.0 - Unauthenticated Arbitrary File Upload via main_user.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-7134. PoCs published by Craig Heffner.
AI-analyzed exploit summary The exploit describes an information disclosure vulnerability in HTTP Upload Tool For PHP 1.0, where the download.php file allows unauthenticated users to read arbitrary files due to lack of input validation. The vulnerability is demonstrated via directory traversal attacks to access sensitive files like users.conf or /etc/passwd.
Description
Unrestricted file upload vulnerability in main_user.php in Upload Tool for PHP 1.0 allows remote attackers to upload and execute arbitrary files with executable extensions such as .php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (1)
The exploit describes an information disclosure vulnerability in HTTP Upload Tool For PHP 1.0, where the download.php file allows unauthenticated users to read arbitrary files due to lack of input validation. The vulnerability is demonstrated via directory traversal attacks to access sensitive files like users.conf or /etc/passwd.