CVE-2007-0337
KGB < 1.9 - Directory Traversal and Arbitrary File Execution via skinnn Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-0337. PoCs published by Kacper.
AI-analyzed exploit summary This exploit targets a remote code execution vulnerability in KGB Forum <= 1.9 by injecting malicious PHP code via a crafted POST request and then triggering its execution through a path traversal vulnerability.
Description
Directory traversal vulnerability in sesskglogadmin.php in KGB 1.9 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skinnn parameter, as demonstrated by invoking kg.php with a postek parameter containing PHP code, which is injected into a file in the kg directory, and then included by sesskglogadmin.php.
Exploits (1)
This exploit targets a remote code execution vulnerability in KGB Forum <= 1.9 by injecting malicious PHP code via a crafted POST request and then triggering its execution through a path traversal vulnerability.