CVE-2007-1771

Ay System Solutions Web Content System 2.7.1 - Remote File Inclusion via formjavascript.php

Title source: manual

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1771. PoCs published by kezzap66345.

AI-analyzed exploit summary This is a client-side HTML/JavaScript exploit for a Remote File Include (RFI) vulnerability in Web Content System v2.7.1. It constructs a malicious URL to include a remote shell script via the 'path[JavascriptEdit]' parameter.

Description

PHP remote file inclusion vulnerability in manage/javascript/formjavascript.php in Ay System Solutions Web Content System (WCS) 2.7.1 allows remote attackers to execute arbitrary PHP code via a URL in the path[JavascriptEdit] parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by kezzap66345 · htmlwebappsphp

https://www.exploit-db.com/exploits/3592

View Code ZIP pw:eip

This is a client-side HTML/JavaScript exploit for a Remote File Include (RFI) vulnerability in Web Content System v2.7.1. It constructs a malicious URL to include a remote shell script via the 'path[JavascriptEdit]' parameter.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Web Content System v2.7.1

No auth needed

Prerequisites: Victim must visit the malicious HTML page · Remote shell script must be accessible

MITRE ATT&CK