CVE-2007-1908

PHP121 Instant Messenger 2.2 - Remote PHP Code Execution via php121dir Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1908. PoCs published by Dj7xpl.

AI-analyzed exploit summary This is a writeup describing a Local File Inclusion (LFI) vulnerability in PHP121 Version 2.2. The vulnerability allows an attacker to include local files via a null-byte termination in the 'php121dir' parameter.

Description

PHP file inclusion vulnerability in php121db.php in PHP121 Instant Messenger 2.2 allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the php121dir parameter, which is accessed by the file_exists function.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Dj7xpl · textwebappsphp

https://www.exploit-db.com/exploits/3694

View Code ZIP pw:eip

This is a writeup describing a Local File Inclusion (LFI) vulnerability in PHP121 Version 2.2. The vulnerability allows an attacker to include local files via a null-byte termination in the 'php121dir' parameter.

Classification

Writeup 90%

Attack Type

Other

Complexity

Trivial

Reliability

Reliable

Target: PHP121 Version 2.2

No auth needed

Prerequisites: Access to the target application

MITRE ATT&CK