Exploitation Summary
EIP tracks 2 public exploits for CVE-2007-2304. PoCs published by GoLd_M, Omni.
AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Quick and Dirty Blog 0.4 via the 'theme' parameter in categories.php. The PoC uses directory traversal to read /etc/passwd by injecting a null byte to bypass file extension checks.
Description
Multiple directory traversal vulnerabilities in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter to categories.php and other unspecified files.
Exploits (2)
This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Quick and Dirty Blog 0.4 via the 'theme' parameter in categories.php. The PoC uses directory traversal to read /etc/passwd by injecting a null byte to bypass file extension checks.
The writeup describes SQL injection and local file inclusion vulnerabilities in QDBlog v0.4. It includes proof-of-concept examples for bypassing admin authentication and reading arbitrary files.