CVE-2007-0871

eXtremePow eXtreme File Hosting - Unrestricted File Upload via Double Extension Bypass

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-0871. PoCs published by hamed bazargani.

AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in eXtreme File Hosting by copying a remote PHP file to the target server. It leverages insufficient input sanitization to execute arbitrary PHP code.

Description

Unrestricted file upload vulnerability in eXtremePow eXtreme File Hosting allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as (1) .rar.php or (2) .zip.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by hamed bazargani · phpwebappsphp

https://www.exploit-db.com/exploits/29574

View Code ZIP pw:eip

This exploit demonstrates an arbitrary file upload vulnerability in eXtreme File Hosting by copying a remote PHP file to the target server. It leverages insufficient input sanitization to execute arbitrary PHP code.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: eXtreme File Hosting (version not specified)

No auth needed

Prerequisites: Remote PHP file accessible via URL · Write permissions on the target server

MITRE ATT&CK