CVE-2007-1255
Connectix Boards <= 0.7 - Authenticated Arbitrary PHP Code Execution via GIF Smiley Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-1255. PoCs published by DarkFig.
AI-analyzed exploit summary This exploit targets Connectix Boards <= 0.7, leveraging SQL injection for privilege escalation and arbitrary file upload for remote code execution. It authenticates, injects malicious SQL to escalate privileges, and uploads a fake JPG containing PHP code to achieve RCE.
Description
Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smiley image with a .php extension via the uploadimage parameter to admin.php, which can be later accessed via a direct request for the file in smileys/. NOTE: this can be leveraged with a separate SQL injection issue for remote unauthenticated attacks.
Exploits (1)
This exploit targets Connectix Boards <= 0.7, leveraging SQL injection for privilege escalation and arbitrary file upload for remote code execution. It authenticates, injects malicious SQL to escalate privileges, and uploads a fake JPG containing PHP code to achieve RCE.