CVE-2007-2457

Pixaria Gallery < 1.4.3 - Remote File Inclusion via cfg[sys][base_path] Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-2457. PoCs published by irvian.

AI-analyzed exploit summary This exploit demonstrates a Remote File Include (RFI) vulnerability in Pixaria Gallery 1.x via the 'cfg[sys][base_path]' parameter in 'class.Smarty.php'. The attacker can include arbitrary remote PHP code by manipulating the parameter.

Description

PHP remote file inclusion vulnerability in resources/includes/class.Smarty.php in Pixaria Gallery before 1.4.3 allows remote attackers to execute arbitrary PHP code via a URL in the cfg[sys][base_path] parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by irvian · textwebappsphp

https://www.exploit-db.com/exploits/3733

View Code ZIP pw:eip

This exploit demonstrates a Remote File Include (RFI) vulnerability in Pixaria Gallery 1.x via the 'cfg[sys][base_path]' parameter in 'class.Smarty.php'. The attacker can include arbitrary remote PHP code by manipulating the parameter.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Pixaria Gallery 1.x

No auth needed

Prerequisites: Remote PHP file hosting · Target server with allow_url_include enabled

MITRE ATT&CK