CVE-2007-0499

phpIndexPage <= 1.0.1 - Remote Code Execution via env[inc_path] Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-0499. PoCs published by DeltahackingTEAM.

AI-analyzed exploit summary This exploit targets a Remote File Include (RFI) vulnerability in phpindexpage 1.0 and 1.0.1 via the 'env[inc_path]' parameter in config.php. It allows an attacker to include a remote shell script and execute arbitrary commands on the target system.

Description

PHP remote file inclusion vulnerability in config.php in Sangwan Kim phpIndexPage 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the env[inc_path] parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by DeltahackingTEAM · perlwebappsphp

https://www.exploit-db.com/exploits/3164

View Code ZIP pw:eip

This exploit targets a Remote File Include (RFI) vulnerability in phpindexpage 1.0 and 1.0.1 via the 'env[inc_path]' parameter in config.php. It allows an attacker to include a remote shell script and execute arbitrary commands on the target system.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: phpindexpage 1.0 & 1.0.1

No auth needed

Prerequisites: Target must have allow_url_include enabled in PHP configuration · Remote shell script must be accessible via URL

MITRE ATT&CK