CVE-2007-1024

Meganoide's news 1.1.1 - Remote File Inclusion via _SERVER[DOCUMENT_ROOT] Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1024. PoCs published by KaRTaL.

AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in Meganoide's news version 1.1.1 by manipulating the `_SERVER[DOCUMENT_ROOT]` parameter to include arbitrary PHP code. The attack leverages insufficient input sanitization to achieve remote code execution.

Description

PHP remote file inclusion vulnerability in include.php in Meganoide's news 1.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by KaRTaL · textwebappsphp

https://www.exploit-db.com/exploits/29609

View Code ZIP pw:eip

This exploit demonstrates a remote file inclusion vulnerability in Meganoide's news version 1.1.1 by manipulating the `_SERVER[DOCUMENT_ROOT]` parameter to include arbitrary PHP code. The attack leverages insufficient input sanitization to achieve remote code execution.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Meganoide's news 1.1.1

No auth needed

Prerequisites: Access to the target web application · Ability to host or reference a malicious PHP shell

MITRE ATT&CK