CVE-2007-1778

eve-nuke_forum - Remote File Inclusion via phpbb_root_path Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1778. PoCs published by ThE TiGeR.

AI-analyzed exploit summary This exploit leverages a file inclusion vulnerability in Eve-Nuke Portal by manipulating the `phpbb_root_path` parameter to include a remote shell. The vulnerable code dynamically includes a file without proper validation, allowing arbitrary file inclusion.

Description

PHP remote file inclusion vulnerability in db/mysql.php in the Eve-Nuke 0.1 (EN-Forums) module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by ThE TiGeR · textwebappsphp

https://www.exploit-db.com/exploits/3591

View Code ZIP pw:eip

This exploit leverages a file inclusion vulnerability in Eve-Nuke Portal by manipulating the `phpbb_root_path` parameter to include a remote shell. The vulnerable code dynamically includes a file without proper validation, allowing arbitrary file inclusion.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Eve-Nuke Portal (EN-Forums beta)

No auth needed

Prerequisites: Remote shell accessible via URL · Target running Eve-Nuke Portal with vulnerable configuration

MITRE ATT&CK