CVE-2007-0639
GuppY < 4.5.16 - Remote Code Execution via Error Handler Cookie Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-0639. PoCs published by rgod.
AI-analyzed exploit summary This exploit targets a remote command execution vulnerability in Guppy CMS <= 4.5.16 by injecting malicious PHP code via manipulated HTTP headers and form data. It bypasses PHP security settings like magic_quotes_gpc and register_globals through a combination of cookie and POST parameter manipulation.
Description
Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject arbitrary PHP code into a .inc file in the data/ directory via (1) a REMOTE_ADDR cookie or (2) a cookie specifying an element of the msg array with an error number in the first dimension and 0 in the second dimension, as demonstrated by msg[999][0].
Exploits (1)
This exploit targets a remote command execution vulnerability in Guppy CMS <= 4.5.16 by injecting malicious PHP code via manipulated HTTP headers and form data. It bypasses PHP security settings like magic_quotes_gpc and register_globals through a combination of cookie and POST parameter manipulation.