CVE-2007-0173
L2J Statistik Script <= 0.09 - Directory Traversal via Page Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-0173. PoCs published by Codebreak.
AI-analyzed exploit summary This exploit targets a file inclusion vulnerability in L2J Statistik Script <= v0.09, allowing remote command execution via log poisoning. It works under specific PHP configurations (register_globals=On, magic_quotes=off).
Description
Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enabled and magic_quotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
Exploits (1)
This exploit targets a file inclusion vulnerability in L2J Statistik Script <= v0.09, allowing remote command execution via log poisoning. It works under specific PHP configurations (register_globals=On, magic_quotes=off).