CVE-2007-0205
@lex Guestbook 4.0.2 - Path Traversal via admin/skins.php Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-0205. PoCs published by DarkFig.
AI-analyzed exploit summary This exploit targets @lex Guestbook <= 4.0.2, leveraging SQL injection to extract admin credentials, then using directory traversal to write a malicious PHP skin file for remote command execution.
Description
Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitrary directories via ".." sequences in the (1) aj_skin and (2) skin_edit parameters. NOTE: this can be leveraged for file inclusion by creating a skin file in the lang directory, then referencing that file via the lang parameter to index.php, which passes a sanity check in livre_include.php.
Exploits (1)
This exploit targets @lex Guestbook <= 4.0.2, leveraging SQL injection to extract admin credentials, then using directory traversal to write a malicious PHP skin file for remote command execution.